CVE-2008-6171: Improper Input Validation

includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header...

CUPS < 1.3.10 Multiple Overflows

Binary data 4771.prm...

DEBIAN-CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-5278: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

wordpress -- header rss feed script insertion vulnerability

Secunia reports: Input passed via the HTTP "Host" header is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if malicious data is viewed...

SpeedStream 5200 Authentication Bypass Config Download Vulnerability

No description provided by source. SpeedStream 5200 Authentication Bypass - hkm 12/10/2008 Server: NetPort Software 1.1 It is posible to bypass authentication by modifying the Host header. If you use a Host that is not the authentic one it will not require authentication. http://189.255.255.255./...

speedstream-bypass.txt

SpeedStream 5200 Authentication Bypass - hkm 12/10/2008 Server: NetPort Software 1.1 It is posible to bypass authentication by modifying the Host header. If you use a Host that is not the authentic one it will not require authentication. http://189.255.255.255./ - This would bypass authentication...

IBM WebSphere Application Server < 6.0.2.31 Multiple Vulnerabilities

Binary data 4725.prm...

CVE-2008-4678: Undefined Security Weakness

The HTTPRequestParser method in the HTTP Transport component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.31 allows remote attackers to cause a denial of service controller 0C4 abend and application hang via a long HTTP Host header, related to "storage overlay" on the stack and a...

8E6科技R3000 Internet过滤器Host头绕过检测漏洞

BUGTRAQ ID: 30541 8e6科技的R3000上网行为管理系统是软硬件集成的系统，允许管理者能有效控制与管理互联网用户的上网行为。 R3000 Internet过滤器所提供的HTTP URL过滤功能没有正确的验证Host头，用户可以访问设备设置了访问限制的网站。但用户无法利用这个漏洞绕过基于IP地址的过滤限制。 8E6 Technologies R3000 Internet Filter 2.0.12.10 8E6 Technologies ---------------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Design/Logic Flaw

8e6 R3000 Internet Filter 2.0.12.10 allows remote attackers to bypass intended restrictions via an extra HTTP Host header with additional leading text placed before the real Host header...

CVE-2008-3494

8e6 R3000 Internet Filter 2.0.12.10 allows remote attackers to bypass intended restrictions via an extra HTTP Host header with additional leading text placed before the real Host header...

CVE-2008-3494

8e6 R3000 Internet Filter 2.0.12.10 allows remote attackers to bypass intended restrictions via an extra HTTP Host header with additional leading text placed before the real Host header...

CVE-2008-3494

The CVE-2008-3494 entry concerns the 8e6 R3000 Internet Filter version 2.0.12.10. The issue is a header-parsing bypass: remote attackers can bypass intended restrictions by sending an extra HTTP Host header with leading text before the real Host header. This is caused by how the filter parses the...

CVE-2008-3494: Undefined Security Weakness

8e6 R3000 Internet Filter 2.0.12.10 allows remote attackers to bypass intended restrictions via an extra HTTP Host header with additional leading text placed before the real Host header...

SonicWALL Email Security Error Page Cross-Site Scripting Vulnerability

Cross-site scripting XSS vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page. CVE: CVE-2008-2162 Last updated: Aug. 8, 2017, 1:3...

CVE-2008-2162

Cross-site scripting XSS vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page...

CVE-2008-2162: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page...

sonicwall-xss.txt

Affected Software/Device: SonicWall E-mail Security Version: 6.1.1 Vulnerability: Cross Site Scripting Risk: Low Description: SonicWALL Email Security is award-winning anti-spam, anti-virus, anti-phishing, policy, and compliance management e-mail protection solution. Available as a hardened...