655 matches found
CVE-2020-10792: Incorrect Default Permissions
openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header...
CVE-2014-2050
Cross-site request forgery CSRF vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header...
CVE-2014-2050
Cross-site request forgery CSRF vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header...
CVE-2014-2050
Cross-site request forgery CSRF vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header...
CVE-2014-2050: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header...
PT-2020-7619
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for password reset requests by crafting an HTTP Ho...
CVE-2019-17392
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...
Default credentials
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...
CVE-2019-17392
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...
PT-2019-15125
Name of the Vulnerable Software and Affected Versions Progress Sitefinity version 12.1 Description The issue is related to a weak password recovery mechanism for forgotten passwords. This is due to the mishandling of the HTTP Host header, which can be exploited. Recommendations For Progress...
CVE-2019-17392: Weak Password Recovery Mechanism for Forgotten Password
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...
httpd: mod_http2: possible crash on late upgrade
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server...
CVE-2018-13257
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...
Design/Logic Flaw
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...
CVE-2018-13257
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...
CVE-2018-13257
The CVE-2018-13257 vulnerability affects Blackboard Learn (2018-07-02) in the bb-auth-provider-cas authentication module. The issue is HTTP host header spoofing during CAS service ticket validation, enabling a phishing attack from the CAS server login page. Connected records consistently describe...
CVE-2018-13257: URL Redirection to Untrusted Site
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...
CVE-2008-6171
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header...
