4952 matches found
CVE-2013-4752
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to...
PT-2020-7507
Name of the Vulnerable Software and Affected Versions: Symfony versions 2.0.X through 2.3.X before 2.0.24, 2.1.12, 2.2.5, and 2.3.3 Symfony version 2.0.X before 2.0.24 Symfony version 2.1.X before 2.1.12 Symfony version 2.2.X before 2.2.5 Symfony version 2.3.X before 2.3.3 However, to follow the...
CVE-2013-4752: Improper Neutralization of Input During Web Page Generation
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to...
Security Bulletin: IBM Operations Analytics - Log Analysis is vulnerable to potential Host Header Injection (CVE-2019-4216)
Summary IBM Operations Analytics - Log Analysis is vulnerable to HTTP header injection, as attacker can abuse the HTTP Host header. Vulnerability Details CVEID: CVE-2019-4216 DESCRIPTION: CVSS Base score: 4.6 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159187 fo...
Envoy Null Pointer Dereference Vulnerability
Envoy is an open source, high performance edge, middle and service agent. A null pointer dereference vulnerability exists in Envoy 1.12.0, which can be exploited to cause an abnormal termination of an Envoy process by sending a malformed HTTP request without a Host header...
Nord Security: Host header injection/redirection | signup and login page
Hey Team. There's a host header injection vulnerability in signup and login page. If possible, the application should avoid incorporating user-controllable data into redirection targets. In many cases, this behavior can be avoided in two ways: Remove the redirection function from the application,...
CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
Null pointer dereference
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
CVE-2019-18838: NULL Pointer Dereference
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
PT-2019-15674 · Envoy +1 · Envoy +1
Name of the Vulnerable Software and Affected Versions: Envoy version 1.12.0 Description: An issue was discovered where an untrusted remote client can send an HTTP header, such as the Host header, with whitespace after the header content. This allows the client to bypass matchers, for example, by...
CVE-2019-18802: Undefined Security Weakness
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header such as Host with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass...
PT-2019-15692
Name of the Vulnerable Software and Affected Versions Envoy version 1.12.0 Description An issue was discovered where upon receipt of a malformed HTTP request without a Host header, Envoy sends an internally generated "Invalid request" response. This response is dispatched through the configured...
envoy: malformed HTTP request without the Host header may cause abnormal termination of the Envoy process
A flaw was found in envoy. A malformed HTTP request without the Host header may cause abnormal termination of the Envoy process. The highest threat from this vulnerability is to system availability...
CVE-2019-18838
A flaw was found in envoy. A malformed HTTP request without the Host header may cause abnormal termination of the Envoy process. The highest threat from this vulnerability is to system availability...
CVE-2019-17392
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...