CVE-2024-55926 Arbitrary file upload, deletion and read through header manipulation

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...

CVE-2024-55925

CVE-2024-55925 affects Xerox Workplace Suite. The issue is an API access bypass via manipulating the Host header, exploiting improper host validation that can allow forging a value to access restricted API endpoints. Documents confirm the vulnerability impacts Xerox Workplace Suite versions prior...

CVE-2024-55925 API Security bypass through header manipulation

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...

CVE-2024-55925 API Security bypass through header manipulation

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...

Xerox Workplace Suite 安全漏洞

Xerox Workplace Suite is a powerful print management software from Xerox. A security vulnerability exists in Xerox Workplace Suite version 5.6.701.9, which originates from the ability to arbitrarily upload, delete, and read files by manipulating the header...

CVE-2024-45687 HTTP Server incorrectly accepting disallowed characters within header values

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in Payara Platform Payara Server Grizzly, REST Management Interface modules, Payara Platform Payara Micro Grizzly modules allows Manipulating State, Identity Spoofing.This issue affects Payar...

CVE-2024-45687

CVE-2024-45687 involves Improper Neutralization of CRLF Sequences in HTTP Headers in Payara Server and Payara Micro (Grizzly, REST Management Interface modules). Affected products/versions include Payara Server 4.1.151–4.1.2.191.51; 5.20.0–5.70.0; 5.2020.2–5.2022.5; 6.2022.1–6.2024.12; 6.0.0–6.21...

Payara Server和Payara Micro 注入漏洞

Payara Server and Payara Micro are both products of Payara, Inc. of the U.K. Payara Server is a cloud-native, innovative, open-source middleware platform. payara Micro is an open-source, lightweight middleware platform for containerized Jakarta EE Java EE application deployment. An injection...

CVE-2023-28362

The redirectto method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header...

CVE-2024-12988 Netgear R6900P/R7000P HTTP Header sub_16C4C buffer overflow

A vulnerability has been found in Netgear R6900P and R7000P 1.3.3.154 and classified as critical. Affected by this vulnerability is the function sub16C4C of the component HTTP Header Handler. The manipulation of the argument Host leads to buffer overflow. The attack can be launched remotely. The...

CVE-2024-30129

The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address...

PT-2024-23202 · Hcl +1 · Hcl Nomad Server On Domino +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The HTTP host header can be manipulated, causing the application to behave in unexpected ways. Any changes made to the header would cause the request to...

HCL Nomad 安全漏洞

HCL Nomad is an application from HCL Corporation, USA for using and managing the Domino application development platform in mobile devices. A security vulnerability exists in HCL Nomad that stems from the HTTP host header that can be manipulated...

USN-7135-1: HAProxy vulnerability

Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg, and Harvey Tuch discovered that HAProxy incorrectly handled empty header names. A remote attacker could possibly use this issue to manipulate headers and bypass certain authentication checks and restrictions...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 CVE-2022-1388 is a serious vulnerabil...

Medium: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's defaul...

Medium: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's defaul...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection due to header-related attributes: Header, HeaderCollection and Authorize, through the HttpHeaders.TryAddWithoutValidation method. An attacker can manipulate HTTP headers or perform HTTP request smuggling. Notes: 1 This is...

Sinatra 安全漏洞

Sinatra is a Sinatra open source DSL for quickly creating web applications in Ruby with minimal effort A security vulnerability exists in Sinatra. An attacker exploiting this vulnerability can trigger an open redirection attack by inserting an arbitrary address in the header...

Consul L7 Intentions Vulnerable To Headers Bypass

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using Headers in L7 traffic intentions could bypass HTTP header based access rules. This vulnerability, identified as CVE-2024-10006, is fixed in Consul Community Edition 1.20.1 and Consul Enterprise 1.20.1,...