CVE-2016-2560: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Host HTTP header, related to libraries/Config.class.php; 2 crafted JSON data, relat...

Concrete CMS: Unsafe usage of Host HTTP header in Concrete5 version 5.7.3.1

Concrete5 is affected by a design issue related to the Host HTTP header. Such header is being used to define the base URL for the application. Since the Host header can be arbitrarily manipulated by an attacker, this can have some security impacts...

PT-2016-5207

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.14 phpMyAdmin versions 4.4.x through 4.4.15.4 phpMyAdmin versions 4.5.x through 4.5.5.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via various means, including ...

Ubuntu Update for python-django USN-1632-2

Ubuntu Update for Linux kernel vulnerabilities USN-1632-2 OpenVAS Vulnerability Test $Id: gbubuntuUSN16322.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for python-django USN-1632-2 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.ne...

Ubuntu Update for python-django USN-1632-1

Ubuntu Update for Linux kernel vulnerabilities USN-1632-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN16321.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for python-django USN-1632-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.ne...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : python-django vulnerability (USN-1632-1)

James Kettle discovered Django did not properly filter the Host HTTP header when processing certain requests. An attacker could exploit this to generate and display arbitrary URLs to users. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

USN-1632-1: Django vulnerability

James Kettle discovered Django did not properly filter the Host HTTP header when processing certain requests. An attacker could exploit this to generate and display arbitrary URLs to users...

CVE-2012-3828

Cross-site scripting XSS vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header...

CVE-2012-3829

Affected product: Joomla! 2.5.3. Vulnerability: exposes the installation path to remote attackers via the Host HTTP header, enabling information disclosure. Root cause: improper handling of the Host header leading to path disclosure. Impact: partial confidentiality breach (installation path expos...

CVE-2012-3828

CVE-2012-3828 affects Joomla! 2.5.3 with a cross-site scripting (XSS) vulnerability exploitable via the Host HTTP Header, allowing remote script/HTML injection. Root cause described as insufficient validation of the Host header. Impact is client-side script execution potential; no explicit exploi...

CVE-2012-3829: Exposure of Sensitive Information to an Unauthorized Actor

Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header...

CVE-2012-3828: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header...

PT-2012-5024

Name of the Vulnerable Software and Affected Versions Joomla! version 2.5.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header. Recommendations For Joomla! version 2.5.3, update to a newer version to mitigate the ri...

PT-2012-5025

Name of the Vulnerable Software and Affected Versions Joomla! version 2.5.3 Description The issue allows remote attackers to obtain the installation path via the Host HTTP Header. Recommendations For version 2.5.3, update to a newer version to mitigate the risk...

CVE-2012-2213

Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and...

Design/Logic Flaw

DISPUTED McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details for the...

CVE-2012-2212

CVE-2012-2212 affects McAfee Web Gateway 7.0. The issue arises when the appliance bypasses the access configuration for the CONNECT method based on the Host header, allowing an arbitrary allowed hostname to bypass URL filtering. Public Red Hat/RedHat-like entries corroborate the behavior and note...

CVE-2012-2213

CVE-2012-2213 affects Squid 3.1.9. The issue allows remote attackers to bypass access control for the CONNECT method by supplying an arbitrary hostname in the Host HTTP header, enabling potential access to blocked sites via SSL. The core cause is host header-based ACL evaluation in the CONNECT ha...

CVE-2012-2213: Undefined Security Weakness

Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and...

CVE-2012-2212: Undefined Security Weakness

McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details for the vulnerable...