Design/Logic Flaw

CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection...

CVE-2019-13285

CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection...

CVE-2019-13285

CVE-2019-13285 affects CoSoSys Endpoint Protector 5.1.0.2, as shown by multiple connected records. The vulnerability is described as a Host Header Injection in Endpoint Protector; the available sources do not provide detailed exploitation vectors or affected components beyond the general product/...

CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

Design/Logic Flaw

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

CVE-2019-12425

CVE-2019-12425 affects Apache OFBiz 17.12.01 and is described as a Host header injection vulnerability caused by accepting arbitrary Host headers. This is documented across multiple sources (e.g., NVD entry and Red Hat, CNVD, OSV, CVE lists) with the consistent description that OFBiz 17.12.01 is ...

CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

ruby: HTTP response splitting in WEBrick

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

Design/Logic Flaw

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

CVE-2020-11814

CVE-2020-11814 describes a Host Header Injection in qdPM 9.1 that can allow an attacker to spoof a header and redirect users to malicious sites. Connected sources (Red Hat, CNVD, CVE.org, NVD, PRION, etc.) confirm the issue but do not provide detailed technical exploit steps, affected component g...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

Insecure HTTP Headers

firefox is vulnerable to insecure HTTP headers. The vulnerability exists as a flaw was found in the way Firefox handled pages with multiple Content Security Policy CSP headers. This could lead to a cross-site scripting attack if used in conjunction with a website that has a header injection flaw...

Security Bulletin: Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7

Summary Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7. CVE-2019-9948 and CVE-2019-9947 are fixed in RHEL7 as part of Errata RHSA-2019:2030 https://access.redhat.com/errata/RHSA-2019:2030. This update is included in Resilient 34.1.53, released on September...

Jooby Environmental Issues Vulnerability

Jooby is a modular micro-Web framework for Java and Kotlin . An environmental issue vulnerability exists in Jooby versions prior to 2.2.1 that stems from a user input validation error in the response header. A remote attacker can exploit this vulnerability to inject arbitrary HTTP headers...

python-twisted-web security update

12.1.0-6 - Fix CVE-2019-12387 HTTP Header Injection Resolves: rhbz1721518...

WHO COVID-19 Mobile App: Probably unexploitable XSS via Header Injection

Summary: The Who-Platform header is reflected in the output of the page if it's not one of the recognized Who-Platform values IOS, ANDROID, WEB. While this is probably no longer exploitable as of 2015, it may be exploitable on less well implemented browsers not Chrome/Firefox/Edge. In general,...