Mozilla Firefox Thunderbird HTTP Header Injection

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers, such as Set-Cooki...

Rocky Linux 8 : grafana (RLSA-2021:4226)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4226 advisory. - The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call...

Header injection in proxy login page

...

CVE-2021-31988

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed CRLF control characters and include arbitrary SMTP headers in the generated test email...

golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards connection headers if the first one was empty. This flaw allows an attacker to drop arbitrary headers. The highest threat from this vulnerability is to integrity...

AZL-98925 CVE-2021-33197 affecting package golang 1.27.1-1

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy from net/http/httputil result in a situation where an attacker is able to drop arbitrary headers...

Design/Logic Flaw

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy from net/http/httputil result in a situation where an attacker is able to drop arbitrary headers...

UBUNTU-CVE-2021-33197

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy from net/http/httputil result in a situation where an attacker is able to drop arbitrary headers...

CVE-2021-33197

Removed by vendor...

Google Golang has an unspecified vulnerability (CNVD-2022-02629)

Google Golang is a statically strongly typed, compiled language from Google, Inc. A security vulnerability exists in Google Golang, which can be exploited by attackers to cause arbitrary headers to be dropped...

Google Golang security vulnerabilities

Google Golang is a statically strongly typed, compiled language from Google, Inc. A security vulnerability exists in Google Golang, which can be exploited by attackers to cause arbitrary headers to be dropped...

PT-2021-6521

Name of the Vulnerable Software and Affected Versions Go versions 1.15.12 and earlier Go versions 1.16.x before 1.16.5 Description The issue is related to the ReverseProxy component from net/http/httputil in the Go programming language, which can result in a situation where an attacker can drop...

Session Fixation

firefox is vulnerable to session fixation. Firefox for Android allows a malicious application to broadcast a user's Intent with arbitrary headers, allowing attacks such as session fixation...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

Session fixation

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-26975: Undefined Security Weakness

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 84. When a malicious application installed on a user's device broadcasts intent to Firefox for Android, it can specify arbitrary...

CVE-2020-3117 Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...