CVE-2020-18984

A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...

CVE-2020-18984

CVE-2020-18984 describes a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration 8.8.12, specifically in the zimbraAdmin/public/secureRequest.jsp component. The issue allows unauthenticated attackers to execute arbitrary web scripts or HTML through host header injection. The ...

Zimbra cross-site scripting vulnerabilities

Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...

PT-2021-10262

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration version 8.8.12 Description: A reflected cross-site scripting XSS issue exists, allowing unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection in the...

CVE-2020-18984: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...

GHSA-HWQF-GCQM-7353 Header injection in nodemailer

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object...

Header injection in nodemailer

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object...

Log4Shell HTTP Header Injection

Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will exploit an HTTP end point with the Log4Shell vulnerability by...

OrbiTeam BSCW Server XSS / LFI / User Enumeration

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities in BSCW Server product: OrbiTeam BSCW Server vulnerable version: BSCW Server 5.0.x, 5.1.x, =5.2.4, =7.3.x, =7.4.3 fixed version: 5.2.5, 7.4.4 CVE...

MGASA-2021-0519 Updated php packages fix security vulnerability

Header injection via defaultmimetype / defaultcharset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function CVE-2021-21707 XMLReader::getParserProperty may throw with a valid property...

Updated php packages fix security vulnerability

Header injection via defaultmimetype / defaultcharset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function CVE-2021-21707 XMLReader::getParserProperty may throw with a valid property...

CVE-2021-36322

Dell Networking X-Series firmware versions prior to 3.0.1.8 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary host header values to poison the web-cache or trigger redirections...

CVE-2021-36322

CVE-2021-36322 affects Dell Networking X-Series firmware prior to 3.0.1.8. A host header injection vulnerability allows a remote unauthenticated attacker to inject arbitrary host header values to poison web caches or trigger redirects. Affected component: Dell Networking X-Series firmware (prior ...

Dell Networking X-Series injection vulnerability

Dell Networking X-Series is a series of intelligent managed switches from Dell, U.S. A HOST injection vulnerability exists in Dell Networking X-Series, which can be exploited by remote, unauthenticated attackers to poison web caches or trigger redirects by injecting arbitrary host header values...

PT-2021-21224 · Dell · Dell Networking X-Series

Name of the Vulnerable Software and Affected Versions: Dell Networking X-Series firmware versions prior to 3.0.1.8 Description: The issue allows a remote unauthenticated attacker to potentially exploit the vulnerability by injecting arbitrary host header values to poison the web-cache or trigger...

CVE-2021-36322: Improper Input Validation

Dell Networking X-Series firmware versions prior to 3.0.1.8 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary host header values to poison the web-cache or trigger redirections...

GitHub Security Lab: [Python]: CWE-079: HTTP Header injection

This bug was reported directly to GitHub Security Lab...

CVE-2021-25980

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

CVE-2021-25980

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

Design/Logic Flaw

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...