CVE-2025-56266: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL...

CVE-2025-56266

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL...

CVE-2025-56266

A Host Header Injection vulnerability exists in Avigilon ACM v7.10.0.20 , a physical access control system. By supplying a crafted URL , an unauthenticated attacker can achieve remote code execution , potentially compromising the entire system. While the vulnerability is confirmed, the provided d...

Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

...

Linux Distros Unpatched Vulnerability : CVE-2011-4203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows...

CVE-2024-13068 Host Header Injection in Akinsoft's LimonDesk

Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: from s1.02.14 before v1.02.17...

CVE-2024-13068

CVE-2024-13068 describes an Origin Validation Error in Akinsoft LimonDesk that allows Forceful Browsing. Affected versions are s1.02.14 through before v1.02.17. The issue stems from improper origin validation, enabling access to restricted resources without proper authorization. CVSS v3.1 base sc...

CVE-2025-40927

An HTTP response splitting flaw was found in the CGI::Simple Perl module. This flaw in CGI::Simple allows HTTP response header injection, which can be used for a reflected cross-site scripting XSS attack or an open redirect under certain conditions. Although some validation exists, it can be...

Linux Distros Unpatched Vulnerability : CVE-2025-40927

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that...

CVE-2024-12973

CVE-2024-12973 describes an Origin Validation Error in Akinsoft OctoCloud that allows HTTP response splitting. Affected versions are s1.09.01 through before v1.11.01; the issue is mitigated by upgrading to v1.11.01 or later. The root cause is improper origin validation that permits crafted HTTP r...

CVE-2024-12973 Host Header Injection in Akinsoft's OctoCloud

Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from s1.09.01 before v1.11.01...

Linux Distros Unpatched Vulnerability : CVE-2021-39213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API...

Linux Distros Unpatched Vulnerability : CVE-2022-31150

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than...

Linux Distros Unpatched Vulnerability : CVE-2018-14774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, a...

Linux Distros Unpatched Vulnerability : CVE-2021-23400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed...

SUSE CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

DEBIAN-CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

UBUNTU-CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

CVE-2025-40927

The CGI::Simple Perl module in versions before 1.282 contains an HTTP response splitting flaw (CWE-113) caused by insufficient validation of URL-encoded values in query parameters. An attacker can inject a newline character (e.g., %0A ) to bypass existing checks, enabling the injection of arbitra...