Cross-site scripting in imgURL

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...

GHSA-F2RP-J8HV-G5GX Cross-site scripting in imgURL

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...

a2 (>=0.5.0-alpha.6, <=0.5.0-alpha.7), anitable (0.1.0) +66 more potentially affected by CVE-2021-21299 via hyper (>=0.13.0-alpha.1, <=0.13.7)

hyper CARGO version =0.13.0-alpha.1, =0.5.0-alpha.6, =0.1.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.31.1 and more Source cves: CVE-2021-21299 Source advisory: OSV:GHSA-6HFQ-H8HQ-87MF...

algorithmia (3.0.0-beta), approveapi (0.1.0) +159 more potentially affected by CVE-2020-35863 via hyper (>=0.11.27, <=0.12.19)

hyper CARGO version =0.11.27, =0.1.0, =0.2.0, =1.5.0, =0.4.2, =0.1.0, =0.1.0, =0.1.6 - ckb-analyzer 0.39.2 and more Source cves: CVE-2020-35863 Source advisory: OSV:GHSA-H3QR-RQ2J-74W4...

aerial (0.1.0), afterparty (0.1.0) +345 more potentially affected by CVE-2017-18587 via hyper (>=0.0.1, <=0.9.14)

hyper CARGO version =0.0.1, =0.7.0, =0.1.0, =0.1.3, =0.5.1, =0.1.2, =0.5.3, =0.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2017-18587 Source advisory: OSV:GHSA-Q89X-F52W-6HJ2...

CVE-2018-20060

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...

ExponentCMS has an unspecified vulnerability

ExponentCMS is an open source web content management system that allows website owners to easily create and manage dynamic websites without having to directly code web pages or manage site navigation.ExponentCMS 2.6 and earlier versions have a security vulnerability that stems from a modified HTT...

UBUNTU-CVE-2021-29991

Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox 91.0.1 and Thunderbird 91.0.1...

CVE-2021-39242

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled...

CVE-2021-39242

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled...

CVE-2020-4706

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to...

CVE-2020-4706

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to...

Cross site scripting

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to...

CVE-2020-4706

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to...

CVE-2020-4706: Improper Neutralization of Input During Web Page Generation

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to...

Security Bulletin: IBM API Connect on cloud is impacted by HTTP header injection vulnerability (CVE-2020-4706)

Summary IBM API Connect on cloud V5 has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4706 DESCRIPTION: IBM API Connect is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a...

CVE-2021-38713

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...

CVE-2021-38713

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...

Design/Logic Flaw

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...

CVE-2021-38713

The CVE-2021-38713 entry concerns imgURL 2.31, where a cross-site scripting (XSS) vulnerability can be triggered via the X-Forwarded-For HTTP header. Public references and multiple security trackers (Red Hat, GHSA, OSV, NVD, CNVD, etc.) consistently describe imgURL 2.31 as vulnerable to XSS throu...