4908 matches found
CVE-2023-35894
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...
CVE-2023-35894 IBM Control Center HOST header injection
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...
CVE-2023-35894
IBM Control Center (IBM Sterling Control Center) versions 6.2.1 and 6.3.1 are affected by CVE-2023-35894 due to improper validation of HOST header input, enabling HTTP header injection that can lead to cross-site scripting, cache poisoning, or session hijacking. Remediation per IBM bulletin: upgr...
CVE-2023-35894 IBM Control Center HOST header injection
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...
Security Bulletin: IBM Sterling Control Center is vulnerable to HTTP Host Header Injection Vulnerability
Summary HTTP Host Header Injection Vulnerability is affecting Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2023-35894 DESCRIPTION: IBM Sterling Control Center is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow ...
Linux Distros Unpatched Vulnerability : CVE-2023-29406
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests...
Linux Distros Unpatched Vulnerability : CVE-2024-21742
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add...
Linux Distros Unpatched Vulnerability : CVE-2023-38060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface...
CLSA-2025-1741126677 python3.11: Fix of 3 CVEs
CVE-2024-4032: update 'ipaddress' module to correct isprivate and isglobal properties based on latest IANA information - CVE-2024-6923: properly quote newlines for email headers to prevent header injection - CVE-2024-8088: fix issue causing infinite loop when iterating over names of entries in a...
CVE-2025-25477
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...
Host Header Injection
leantime/leantime is vulnerable to Host Header Injection. The vulnerability is due to improper validation of the host header due to the system allowing attackers to manipulate HTTP request headers, leading to unauthorized access to user details...
CVE-2025-25477
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...
sysPass 注入漏洞
SysPass is a system password manager by RubénD Individual Developers. An injection vulnerability exists in sysPass version 3.2x, which stems from host header injection and could lead to the execution of malicious JS files...
CVE-2025-25477
The CVE-2025-25477 entry concerns SysPass 3.2.x, where a host header injection flaw allows loading malicious JavaScript from an arbitrary domain that would execute in a victim’s browser. The root cause is host header injection in SysPass; impact is demonstrated as high confidentiality and integri...
CVE-2025-25477
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...
CVE-2025-25477
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...
CVE-2025-25477
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...
PT-2025-9042 · Syspass · Syspass
Name of the Vulnerable Software and Affected Versions: SysPass versions 3.2.x Description: A host header injection vulnerability in SysPass allows an attacker to load malicious JS files from an arbitrary domain, which would be executed in the victim's browser. Recommendations: For SysPass version...