CVE-2018-2504

CVE-2018-2504 affects SAP NetWeaver AS Java Web Container. The issue arises because the HTTP Host header is not validated against a whitelist, enabling potential HTTP Host Header Manipulation and related XSS . Root cause: missing host header whitelisting in the web container. Impact is mitigated ...

CVE-2018-2504

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2504

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

Cross site scripting

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2504: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

PT-2018-3538

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java Web Container service versions prior to 7.10 SAP NetWeaver AS Java Web Container service versions prior to 7.11 SAP NetWeaver AS Java Web Container service versions prior to 7.20 SAP NetWeaver AS Java Web Container servi...

IBM Connections Host Header Injection Vulnerability (CNVD-2018-26902)

IBM Connections is a social software platform developed by IBM that helps organizations invite the right people to collaborate and accelerate innovation generation and results. IBM Connections suffers from a host header injection vulnerability. An attacker could exploit the vulnerability to...

CVE-2018-1896

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456...

CVE-2018-1896

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456...

Design/Logic Flaw

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456...

CVE-2018-1896

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456...

CVE-2018-1896

IBM Connections versions 5.0, 5.5, and 6.0 are described as vulnerable to a host header injection that could cause navigation to the attacker’s domain. The available connected documents consistently identify this as a host header injection issue but do not provide concrete details on affected com...

CVE-2018-1896: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456...

PT-2018-14744

Name of the Vulnerable Software and Affected Versions IBM Connections versions 5.0 through 6.0 Description The issue allows for a possible host header injection attack, which could cause navigation to the attacker's domain. Recommendations For IBM Connections versions 5.0 through 6.0, at the...

Buffalo TS5600D1206 Access Control Error Vulnerability

The Buffalo TS5600D1206 is a network storage device from the Buffalo Group of Japan. An access control error vulnerability exists in the nasapi in the Buffalo TS5600D1206 version 3.61-0.10, which can be exploited by an attacker to bypass authentication by sending a modified HTTP Host packet heade...

CVE-2018-13324

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

Authentication flaw

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

CVE-2018-13324: Incorrect Authorization

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

PT-2018-11748

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue is related to incorrect access control in the nasapi, allowing attackers to bypass authentication. This can be achieved by sending a modified HTTP Host header. Recommendations For...

CVE-2018-19148: Exposure of Sensitive Information to an Unauthorized Actor

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its...