PT-2023-30555 · Zoho · Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: ManageEngine Desktop Central version 9.1.0 Description: A CRLF injection vulnerability has been found in ManageEngine Desktop Central. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response...

CLSA-2023-1698945913 python3: Fix of CVE-2020-26116

CVE-2020-26116: prevent header injection in http methods...

Snowplow: Unauthorised ██████████ Auth via Token Leakage & HTTP Header Injection

Summary We've identified that your Email Filtering mechanism is misconfigured in the way it visits suspicious links. This behavior is dangerous, as data exfiltration is possible when a 3rd party service sends an incoming email containing sensitive data. A great example would be a reset password...

CVE-2023-36085

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to...

CVE-2023-36085

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to...

CVE-2023-36085

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to...

Design/Logic Flaw

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to...

SISQUAL WFM Input Validation Error Vulnerability

SISQUAL WFM is an intelligent software solution from SISQUAL WFM, Inc. enabling companies around the world to forecast, plan and manage their workforce. A security vulnerability exists in SISQUAL WFM versions 7.1.319.103 through 7.1.319.111, which stems from the presence of a Host Header Injectio...

PT-2023-25424 · Unknown · Sisqualwfm

Name of the Vulnerable Software and Affected Versions: sisqualWFM versions 7.1.319.103 through 7.1.319.111 Description: The issue concerns a host header injection vulnerability in the "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links...

CVE-2023-36085

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to...

CVE-2023-36085

The CVE-2023-36085 issue affects SISQUAL WFM versions 7.1.319.103 through 7.1.319.111, where a Host Header Injection vulnerability exists in the "/sisqualIdentityServer/core/" endpoint. By manipulating the HTTP Host header, an attacker can alter webpage links and redirect users to arbitrary or ma...

[SECURITY] [DLA 3629-1] ceph security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3629-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès October 23, 2023 https://wiki.debian.org/LTS -...

golang: net/http: insufficient sanitization of Host header

A flaw was found in Golang, where it is vulnerable to HTTP header injection caused by improper content validation of the Host header by the HTTP/1 client. A remote attacker can inject arbitrary HTTP headers by persuading a victim to visit a specially crafted Web page. This flaw allows the attacke...

golang: net/http: insufficient sanitization of Host header

A flaw was found in Golang, where it is vulnerable to HTTP header injection caused by improper content validation of the Host header by the HTTP/1 client. A remote attacker can inject arbitrary HTTP headers by persuading a victim to visit a specially crafted Web page. This flaw allows the attacke...

golang: net/http: insufficient sanitization of Host header

A flaw was found in Golang, where it is vulnerable to HTTP header injection caused by improper content validation of the Host header by the HTTP/1 client. A remote attacker can inject arbitrary HTTP headers by persuading a victim to visit a specially crafted Web page. This flaw allows the attacke...

WordPress plugin Page Builder: Pagelayer Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Security Bulletin: Security Vulnerabilities have been identifed in the IBM WebSphere Liberty product as shipped with the IBM Security Verify Access products.

Summary There are multiple Security vulnerabilities affecting IBM WebSphere Liberty have been fixed in the IBM Security Verify Access ISVA Appliance and Container images. Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and...

Node.js: Fetch API did not protect against CRLF injection in host headers

A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection...

Security Bulletin: Operations Dashboard is vulnerable to header injection due to Golang Go

Summary Operations Dashboard is vulnerable to header injection due to Go CVE-2023-29406 with details below. Vulnerability Details CVEID:CVE-2023-29406 DESCRIPTION: Golang Go is vulnerable to HTTP header injection, caused by improper contents validation of Host header by the HTTP/1 client. By...

GHSA-HQP9-MRJW-7QQ2 Economizzer host header injection vulnerability

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 April 2023. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server...