CVE-2022-26616

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

CVE-2022-26616

CVE-2022-26616 affects PKP Vendor Open Journal System versions 2.4.8 through 3.3.8. The vulnerability is a reflected cross-site scripting (XSS) flaw exploitable via crafted HTTP headers, allowing an attacker to inject script that is reflected in the user’s response. Connected sources (Red Hat, NV...

CVE-2022-26616

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

CVE-2022-26616: Improper Neutralization of Input During Web Page Generation

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

PT-2022-17956

Name of the Vulnerable Software and Affected Versions PKP Vendor Open Journal System versions 2.4.8 through 3.3.8 Description The issue allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers. This can potentially lead to unauthorized access or control of...

Unable to launch desktop via Gateway in invoked mode ( Client Detection done and selected workspace to Always Open ICA file )

Unable to launch desktop via Gateway in invoked mode. ICA launch works downloading the file, non invoked mode and clicking on it works In the non-working response for ICA file download, we see Riverbed headers highlighted and the "Connection: close" header being stripped...

CVE-2022-28145

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting XSS exploitable by attackers with Item/Configure permission or otherwise able to control report contents...

PT-2022-28159 · Guzzle +3 · Guzzlehttp/Psr7 +3

Name of the Vulnerable Software and Affected Versions: guzzlehttp/psr7 versions prior to 1.9.1 guzzlehttp/psr7 versions prior to 2.4.5 Description: The issue concerns improper header parsing, allowing an attacker to sneak in a newline into both the header names and values. Many servers will also...

VulnCheck KEV: CVE-2019-10068

Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution...

Kentico Xperience Deserialization of Untrusted Data Vulnerability

Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution...

dev-python/twisted: secret exposure in cross-origin redirects

A flaw was found in the twisted Python library when WebClient redirects via the RedirectAgent and BrowserLikeRedirectAgent methods. This flaw allows an attacker to take advantage of these cross-origin redirects and leak the cookie and authorization headers...

Inproper parsing of HTTP headers

Impact Improper header parsing. An attacker could sneak in a carriage return character \r and pass untrusted values in both the header names and values. Patches The issue is patched in 1.8.4 and 2.1.1. Workarounds There are no known workarounds. References...

PT-2022-29018

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.13 through 5.16.11 Description The issue concerns the handling of outer IP headers in certain network configurations, specifically in cases involving IP-in-IP IPIP and net failover. The problem was introduced in version...

PT-2022-29207

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.269 Description The issue concerns the handling of outer IP headers in certain network configurations, specifically in cases involving IP-in-IP IPIP and net failover. The actual impact and potential for...

PT-2022-29135

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.13 through 5.10.102 Description The issue concerns the handling of outer IP headers in certain network configurations, specifically in cases involving IP-in-IP IPIP and net failover. The problem was introduced in versio...

Click Jacking

sylius/sylius is vulnerable to click-jacking attacks. An attacker can avoid login forms and load the malicious website within an iframe due to the missing HTTP headers...

CVE-2022-22344: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...

Shopware Information Disclosure Vulnerability (CNVD-2022-18524)

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware suffers from an information disclosure vulnerability that stems from not properly setting sensitive HTTP headers to be uncacheable. An attacker could exploit the vulnerability to cause the header to...

Shopware Access Control Error Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware. Shopware is vulnerable to an access control error that stems from not properly setting sensitive HTTP headers to non-cacheable, which could be exploited by an attacker to enable HTTP caching and then have...

HTTP caching is marking private HTTP headers as public in Shopware

Impact HTTP caching is marking private HTTP headers as public Patches Fixed in recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For...