CVE-2022-40870: Improper Encoding or Escaping of Output

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header...

CVE-2022-40870

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header...

CVE-2022-33012

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33012: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-40870

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header...

Microweber injection vulnerability

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images and more. A host header injection vulnerability exists in Microweber v1.2.15. An attacker can explo...

PT-2022-21645

Name of the Vulnerable Software and Affected Versions Microweber version 1.2.15 Description The issue allows attackers to perform an account takeover via a host header injection attack. This enables unauthorized access to user accounts, potentially leading to data breaches or other malicious...

CVE-2022-40870

CVE-2022-40870 affects the Web Client of Parallels Remote Application Server v18.0. The issue is a Host Header Injection that allows an attacker to execute arbitrary commands via a crafted payload in the Host header. CVSSv3.1 base score 8.1 (High) with network access, high complexity, no privileg...

Improper Input Validation

Overview cgi is a Support for the Common Gateway Interface protocol. Affected versions of this package are vulnerable to Improper Input Validation due to improper validation of CGI::Cookie content, which allows an attacker to inject invalid attributes in the Set-Cookie header and insert a newline...

GHSA-VC47-6RQG-C7F5 HTTP response splitting in CGI

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to...

HTTP response splitting in CGI

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to...

SUSE-SU-2022:4074-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-39348: Fixed NameVirtualHost Host header injection bsc1204781...

SUSE: Security Advisory (SUSE-SU-2022:4057-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Rational Asset Analyzer is vulnerable to HTTP header injection (CVE-2022-34165)

Summary IBM WebSphere Application Server Liberty used by Rational Asset Analyzer is vulnerable to HTTP header injection. This has been addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server...

SUSE-SU-2022:4057-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-39348: Fixed NameVirtualHost Host header injection bsc1204781...

SUSE: Security Advisory (SUSE-SU-2022:4000-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BlueSpice cross-site scripting vulnerabilities

BlueSpice is free Wiki software from BlueSpice based on the MediaWiki engine. A cross-site scripting vulnerability exists in BlueSpice versions prior to 4.2.1, which stems from the presence of cross-site scripting XSS that allows a logged-in user with editing privileges to inject arbitrary HTML...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary IBM InfoSphere Master Data Management is affected by IBM WebSphere Application Server vulnerability to HTTP header injection when processing web requests. This has been addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9...

CVE-2022-43562 Host Header Injection in Splunk Enterprise

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and cache poisoning...

CVE-2022-43562 Host Header Injection in Splunk Enterprise

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and cache poisoning...