XSS through header injection in the /browse/~raw resource - CVE-2018-5228

The /browse/raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the handling of response headers...

Incorrect header injection check

Security: Reject header injections correctly, see 4...

Incorrect header injection check

amphp/http isn't properly protected against HTTP header injection...

Promise Technology WebPam Pro-E Appliance HTTP Response Header Injection Vulnerability

Promise Technology WebPam Pro-E devices are a data center device from Promise Technology. A security vulnerability exists in the Promise Technology WebPam Pro-E devices due to a failure to filter parameters in the PHPSESSID cookie. The vulnerability can be exploited by remote attackers to conduct...

TypeSetter CMS 5.1 Host Header Injection

Exploit Title: TypeSetter CMS 5.1 Host Header Injection Date: 10-02-2018 Exploit Author: Navina Asrani Contact: https://twitter.com/NavinaSanjay Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.typesettercms.com/ Version: 5.1 CVE : NA Category: Webapp CMS 1. Description...

TypeSetter CMS 5.1 - Host Header Injection

TypeSetter CMS 5.1 - Host Header Injection ​ Exploit Title: TypeSetter CMS 5.1 Host Header Injection Date: 10-02-2018 Exploit Author: Navina Asrani Contact: https://twitter.com/NavinaSanjay Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.typesettercms.com/ Version: 5.1...

TypeSetter CMS 5.1 - Host Header Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: TypeSetter CMS 5.1 Host Header Injection Exploit Author: Navina Asrani Contact: https://twitter.com/NavinaSanjay Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.typesettercms.com/ Version: 5.1 CVE : N...

TypeSetter CMS 5.1 - 'Host' Header Injection

Exploit Title: TypeSetter CMS 5.1 Host Header Injection Date: 10-02-2018 Exploit Author: Navina Asrani Contact: https://twitter.com/NavinaSanjay Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.typesettercms.com/ Version: 5.1 CVE : NA Category: Webapp CMS 1. Description...

Design/Logic Flaw

An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache or perform advanced password reset attacks or even trigger arbitrary user re-direction...

CVE-2018-6889

An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache or perform advanced password reset attacks or even trigger arbitrary user re-direction...

CVE-2018-6889

TypeSetter CMS 5.1 is affected by a Host header injection vulnerability. The root cause is improper handling of the Host header, enabling attackers to poison web caches, execute advanced password-reset attacks, and trigger arbitrary user redirection. Public disclosures and PoCs in connected sourc...

CVE-2018-6889

An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache or perform advanced password reset attacks or even trigger arbitrary user re-direction...

Typesetter 'Host' Header Injection Vulnerability

Typesetter is a free CMS Content Management System. A security vulnerability exists in Typesetter version 5.1. An attacker can exploit this vulnerability to corrupt the web cache, perform a password reset attack, or redirect users to another website...

Wonder CMS 2.3.1 - Host Header Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wonder CMS 2.3.1 Host Header Injection Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.wondercms.com/ Version: 2.3.1 CVE :...

Wonder CMS 2.3.1 Host Header Injection

Exploit Title: Wonder CMS 2.3.1 Host Header Injection Date: 30-01-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.wondercms.com/ Version: 2.3.1 CVE : CVE-2017-14523 Category: Webapp CMS 1...

Wonder CMS 2.3.1 - 'Host' Header Injection

Exploit Title: Wonder CMS 2.3.1 Host Header Injection Date: 30-01-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.wondercms.com/ Version: 2.3.1 CVE : CVE-2017-14523 Category: Webapp CMS 1...

WonderCMS HTTP Host Header Injection Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. WonderCMS 2.3.1 suffers from an HTTP host header injection vulnerability. An attacker can exploit the vulnerability to redirect pages...

PT-2018-5679 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1 Description: The issue allows for an HTTP Host header injection attack. It utilizes user-entered values to redirect pages. The vendor notes that exploitation is unlikely since the attack can only originate from a local...

CVE-2017-15697

CVE-2017-15697 affects Apache NiFi and relates to handling of the X-ProxyContextPath and X-Forwarded-Context headers. The described vulnerability could enable remote code execution if a malicious header points to external resources or embedded code. The available documents indicate the fix was ap...

CVE-2014-2017

CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Edition before 4.7.11 and 4.8.x before 4.8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP...