Cisco Email Security Appliance (IronPort) C160 - 'Host' Header Injection

!/usr/bin/perl -w Cisco Titsco Email Security Appliance IronPort C160 Header 'Host' Injection Copyright 2019 c Todor Donev Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that Todor Donev i...

Cisco (Titsco) Email Security Appliance (IronPort) C160 Header Injection

!/usr/bin/perl -w Cisco Titsco Email Security Appliance IronPort C160 Header 'Host' Injection Copyright 2019 c Todor Donev Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that Todor Donev i...

Security Bulletin: IBM Jazz for Service Management is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header (CVE-2019-4186)

Summary IBM Jazz for Service Management is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header. Vulnerability Details CVEID: CVE-2019-4186 DESCRIPTION: IBM Jazz for Service Management is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP...

ruby: HTTP response splitting in WEBrick

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...

Host Header Injection

invenio-app is vulnerable to host header injection. The attack exists because it only relies on APPALLOWEDHOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

PYSEC-2019-24

invenio-app before 1.1.1 allows host header injection...

PYSEC-2019-24

invenio-app before 1.1.1 allows host header injection...

Design/Logic Flaw

invenio-app before 1.1.1 allows host header injection...

CVE-2019-1020006

CVE-2019-1020006 affects invenio-app prior to 1.1.1 and allows host header injection due to insufficient validation of host headers via APP_ALLOWED_HOSTS. Multiple sources corroborate a host header injection risk in Invenio-App before the patched versions. The Red Hat advisory reiterates the same...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

CVE-2019-1020006: Improper Neutralization of Special Elements in Output Used by a Downstream Component

invenio-app before 1.1.1 allows host header injection...

PT-2019-20175

Name of the Vulnerable Software and Affected Versions Invenio-App versions prior to 1.1.1 Description The issue allows for host header injection. Recommendations For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue...

Multiple vulnerabilities in Cybozu Garoon

Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. DOM-based cross-site scripting in the application "Portal" CWE-79 - CVE-2019-5975 Denial-of-service DoS CWE-20 - CVE-2019-5976 Mail header injection in the application "E-mail" CWE-74 - CVE-2019-5977...

GHSA-94MF-XFG5-R247 Invenio-App vulnerable to host header injection attack

APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2...

Invenio-App vulnerable to host header injection attack

APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2...

JVN#62618482: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. DOM-based cross-site scripting in the application "Portal" CWE-79 - CVE-2019-5975 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 4.4 CVSS v2|...

PT-2019-11622

Name of the Vulnerable Software and Affected Versions: Invenio-App versions prior to 1.1.1 Description: A host header injection attack has been identified in Invenio-App. This issue can be exploited if the web server is configured to route all requests to the application, the APP ALLOWED HOSTS...

JamieWeb: HTTP Request Smuggling

is vulnerable to host header injection because the host header can be changed to something outside the target domain. Attack vectors are somewhat limited but depends on how the host header is used by the back-end application code. If code references the hostname used in the URL such as password...