CVE-2018-1943: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...

Security Bulletin: IBM Cloud Private is vulnerable to a host header injection attack

Summary IBM Cloud Private is vulnerable to a host header injection attack Vulnerability Details CVEID: CVE-2018-1943 DESCRIPTION: IBM Cloud Private is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a...

CVE-2018-4030

An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...

CVE-2018-4030

An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...

PT-2019-10763

Name of the Vulnerable Software and Affected Versions CUJO Smart Firewall version 7003 Description A vulnerability exists in the safe browsing function, specifically in how it parses HTTP requests. The issue lies in the incorrect extraction of the Host header from captured HTTP requests, allowing...

CVE-2018-4030: Inconsistent Interpretation of HTTP Requests

An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...

PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2019-35826)

PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A cross-site scripting vulnerability exists in the admin/default.php file in PHPMyWind v5.5, which can be exploited by a remote attacker to inject arbitrary Web script or HTML with the help of HTTP...

Design/Logic Flaw

admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header...

CVE-2019-8435

CVE-2019-8435 affects PHPMyWind v5.5, with an XSS vulnerability in admin/default.php exploitable via an HTTP Host header. The connected documents confirm the vulnerability and describe the impact as cross-site scripting, enabling arbitrary script/HTML injection when a crafted Host header is proce...

PT-2019-19035

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue is related to an XSS vulnerability via the HTTP Host header in the admin/default.php file. Recommendations For PHPMyWind version 5.5, update the software to a version that includes a fix for this...

CVE-2019-8435: Improper Neutralization of Input During Web Page Generation

admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header...

CVE-2018-16627

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature...

CVE-2018-16627

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature...

Design/Logic Flaw

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature...

CVE-2018-16627

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature...

CVE-2018-16627

CVE-2018-16627 affects Kirby CMS, specifically the panel/login functionality in version 2.5.12, where a Host header injection is possible through the forget password feature. The connected documents confirm the vulnerability description but do not provide details on affected variants, impact scop...

CVE-2018-16627: Improper Neutralization of Special Elements in Output Used by a Downstream Component

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature...

PT-2018-13653

Name of the Vulnerable Software and Affected Versions Kirby version 2.5.12 Description The issue concerns a Host header injection via the "forget password" feature in the panel/login of Kirby. Recommendations For version 2.5.12, consider disabling the "forget password" feature as a temporary...

The vulnerability of the SUSE Linux SMT subscription management software, related to deficiencies in authentication procedures, allows a perpetrator to replace the server.

The vulnerability of the SUSE Linux Subscription Management Tool SMT is related to deficiencies in the authentication process when the HOST header is used. Exploiting this vulnerability could allow a malicious actor to remotely replace the server...

CVE-2018-2504

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...