3950 matches found
Design/Logic Flaw
DISPUTED A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...
CVE-2023-24044
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...
CVE-2023-24044
CVE-2023-24044 affects Plesk Obsidian up to version 18.0.49. The login page is vulnerable to Host header injection, enabling open redirects to attacker‑controlled sites. Root cause appears to be reliance on the Host header to grant access or redirect, with vendor noting that arbitrary domain name...
CVE-2023-24044
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...
Plesk Obsidian 输入验证错误漏洞
Plesk Obsidian is a hosting control panel from Plesk Switzerland. An input validation error vulnerability exists in Plesk Obsidian version 18.0.49 and prior versions. An attacker could exploit this vulnerability to redirect users to a malicious website via the host request header...
PT-2023-6601 · Plesk · Plesk Obsidian
Name of the Vulnerable Software and Affected Versions: Plesk Obsidian versions through 18.0.49 Description: A Host Header Injection issue on the Login page allows attackers to redirect users to malicious websites via a Host request header. The issue is related to the ability to use arbitrary doma...
Security Bulletin: IBM Spectrum Symphony is vulnerable to Host header injection
Summary IBM Spectrum Symphony 7.3.0 can encounter an unauthenticated Host header injection vulnerability. Vulnerability Details Web servers dispatch requests to the target virtual host based on the value supplied in the Host header. Without proper validation of the header value, the attacker can...
dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK...
Kaltura mwEmbed 跨站脚本漏洞
mwEmbed is Kaltura open source a Kaltura HTML5 media library . Enables you to take advantage of HTML5 and Flash's unified configuration and development API. A cross-site scripting vulnerability exists in versions prior to Kaltura mwEmbed 2.96.rc1, which stems from some unknown processing in the...
Mozilla Firefox Access Control Error Vulnerability (CNVD-2023-03068)
Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox, which stems from the Remote Agent used in WebDriver not validating the Host or Origin header. An attacker could exploit the vulnerability to force...
CVE-2022-22757
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...
CVE-2022-22757
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...
CVE-2022-22757
CVE-2022-22757 concerns Mozilla Firefox and involves the Remote Agent used in WebDriver not validating the Host or Origin headers. This could allow a website to connect back locally to the user's browser to take control, specifically when WebDriver is enabled (not the default). Affected products ...
Fedora 36 : php-pear-CAS (2022-37c2d26f59)
The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-37c2d26f59 advisory. Changes in version 1.6.0 Bug Fixes: Introduce required servicename constructor argument to fix service hostname discovery exploitation vulnerability...
CVE-2022-40624
pfSense pfBlockerNG through 2.1.427 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814...
CVE-2022-40624
pfSense pfBlockerNG through 2.1.427 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814...
Design/Logic Flaw
pfSense pfBlockerNG through 2.1.427 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814...
CVE-2022-40624
pfSense pfBlockerNG through 2.1.427 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814...
CVE-2022-40624
pfSense pfBlockerNG through 2.1.427 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814...
PT-2022-25424 · Pfsense · Pfblockerng
Name of the Vulnerable Software and Affected Versions: pfSense pfBlockerNG versions through 2.1.4 27 Description: The issue allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header. Recommendations: For pfSense pfBlockerNG versions through 2.1.4 27, update to a...