CVE-2024-55926

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...

CVE-2024-55925

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...

CVE-2024-55926 Arbitrary file upload, deletion and read through header manipulation

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...

CVE-2024-55926

CVE-2024-55926 affects Xerox Workplace Suite (print server) via crafted header manipulation, enabling arbitrary file read, upload, and deletion due to improper header validation. Root cause: insufficient validation of HTTP headers leading to unauthorized data access. Affected versions: Xerox Work...

CVE-2024-55926 Arbitrary file upload, deletion and read through header manipulation

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...

CVE-2024-55925

CVE-2024-55925 affects Xerox Workplace Suite. The issue is an API access bypass via manipulating the Host header, exploiting improper host validation that can allow forging a value to access restricted API endpoints. Documents confirm the vulnerability impacts Xerox Workplace Suite versions prior...

CVE-2024-55925 API Security bypass through header manipulation

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...

CVE-2024-55925 API Security bypass through header manipulation

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...

Xerox Workplace Suite 安全漏洞

Xerox Workplace Suite is a powerful print management software from Xerox. A security vulnerability exists in Xerox Workplace Suite version 5.6.701.9, which originates from the ability to arbitrarily upload, delete, and read files by manipulating the header...

CVE-2024-45687 HTTP Server incorrectly accepting disallowed characters within header values

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in Payara Platform Payara Server Grizzly, REST Management Interface modules, Payara Platform Payara Micro Grizzly modules allows Manipulating State, Identity Spoofing.This issue affects Payar...

CVE-2024-45687

CVE-2024-45687 involves Improper Neutralization of CRLF Sequences in HTTP Headers in Payara Server and Payara Micro (Grizzly, REST Management Interface modules). Affected products/versions include Payara Server 4.1.151–4.1.2.191.51; 5.20.0–5.70.0; 5.2020.2–5.2022.5; 6.2022.1–6.2024.12; 6.0.0–6.21...

Payara Server和Payara Micro 注入漏洞

Payara Server and Payara Micro are both products of Payara, Inc. of the U.K. Payara Server is a cloud-native, innovative, open-source middleware platform. payara Micro is an open-source, lightweight middleware platform for containerized Jakarta EE Java EE application deployment. An injection...

CVE-2023-28362

The redirectto method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header...

CVE-2024-12988 Netgear R6900P/R7000P HTTP Header sub_16C4C buffer overflow

A vulnerability has been found in Netgear R6900P and R7000P 1.3.3.154 and classified as critical. Affected by this vulnerability is the function sub16C4C of the component HTTP Header Handler. The manipulation of the argument Host leads to buffer overflow. The attack can be launched remotely. The...

CVE-2024-30129

The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address...

HCL Nomad 安全漏洞

HCL Nomad is an application from HCL Corporation, USA for using and managing the Domino application development platform in mobile devices. A security vulnerability exists in HCL Nomad that stems from the HTTP host header that can be manipulated...

PT-2024-23202 · Hcl +1 · Hcl Nomad Server On Domino +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The HTTP host header can be manipulated, causing the application to behave in unexpected ways. Any changes made to the header would cause the request to...

USN-7135-1: HAProxy vulnerability

Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg, and Harvey Tuch discovered that HAProxy incorrectly handled empty header names. A remote attacker could possibly use this issue to manipulate headers and bypass certain authentication checks and restrictions...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 CVE-2022-1388 is a serious vulnerabil...

Medium: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's defaul...