CVE-2021-36322

CVE-2021-36322 affects Dell Networking X-Series firmware prior to 3.0.1.8. A host header injection vulnerability allows a remote unauthenticated attacker to inject arbitrary host header values to poison web caches or trigger redirects. Affected component: Dell Networking X-Series firmware (prior ...

Dell Networking X-Series 注入漏洞

Dell Networking X-Series is a series of intelligent managed switches from Dell, U.S. A HOST injection vulnerability exists in Dell Networking X-Series, which can be exploited by remote, unauthenticated attackers to poison web caches or trigger redirects by injecting arbitrary host header values...

PT-2021-21224 · Dell · Dell Networking X-Series

Name of the Vulnerable Software and Affected Versions: Dell Networking X-Series firmware versions prior to 3.0.1.8 Description: The issue allows a remote unauthenticated attacker to potentially exploit the vulnerability by injecting arbitrary host header values to poison the web-cache or trigger...

RHEL 7 / 8 : OpenShift Container Platform 4.9.6 packages and (RHSA-2021:4118)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4118 advisory. - haproxy: does not ensure that the scheme and path portions of a URI have the expected characters CVE-2021-39240 - haproxy: an HTTP...

CVE-2021-25980

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

CVE-2021-25980

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

Design/Logic Flaw

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

CVE-2021-25980

CVE-2021-25980 describes a Host Header Injection vulnerability in Talkyard. Affected versions include v0.04.01–v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e–v0.2021.02-WIP-879ef3fe1, and tyse-v0.2021.02–tyse-v0.2021.28-af66b6905-regular. An unauthenticated attacker can lure a user to click a link...

CVE-2021-25980 Talkyard - Host-Header Injection Leads to Account Takeover

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

CVE-2021-25980 Talkyard - Host-Header Injection Leads to Account Takeover

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

EulerOS 2.0 SP9 : haproxy (EulerOS-SA-2021-2712)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contai...

haproxy: it can lead to a situation with an attacker-controlled HTTP Host header because a mismatch between Host and authority is mishandled

haproxy was found to be vulnerable to HTTP host header attack: This problem creates a scenario in which it's possible to drop the Host header and use the authority only after forwarding to a second http2 layer, possibly causing two differing values of Host at a different stage. The highest threat...

CVE-2021-43185

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection...

CVE-2021-43185

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection...

Design/Logic Flaw

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection...

CVE-2021-43185

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection...

CVE-2021-43185

JetBrains YouTrack prior to 2021.3.23639 is affected by a Host header injection vulnerability. Root cause: insecure handling of HTTP Host header in YouTrack before the 2021.3.23639 release. Affected product: YouTrack (JetBrains). Impact details are stated in the provided sources as a Host header ...

Accellion FTA SQL Injection Vulnerability

Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to documentroot.html...

CVE-2021-36322

Dell Networking X-Series firmware versions prior to 3.0.1.8 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary host header values to poison the web-cache or trigger redirections...

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in mineweb/minewebcms

Description Hello, In the password reset it is possible to perform a Host Header Injection, so the victim will receive an email pointing to a third party site. By clicking, the attacker will be able to retrieve the victim's account reset token and use it to access his account. From Portswigger :...