TOTOLINK A3600R 安全漏洞

TOTOLINK A3600R is a 6-antenna 1200M wireless router from China Gion Electronics. The TOTOLINK A3600R suffers from a buffer overflow vulnerability, which is located in the /cgi-bin/cstecgi.cgi?action=save&setting file, and stems from improper handling of the httphost parameter. An attacker can...

RubyGems: Host Header Attac

The application was vulnerable to a Host Header Injection vulnerability. The Host header was manipulated to redirect users to arbitrary domains or potentially poison web caches...

CVE-2024-41801 OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration

OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the "Login required" setting, an attacker could redirect to a remote host to initiate a phishing attack against an OpenProje...

CVE-2024-41801

OpenProject prior to 14.3.0 is affected by an open redirect/phishing vulnerability caused by accepting forged HOST headers in default packaged installations with the Login required setting. The issue could allow redirection to a remote host when HOST/X-Forwarded-Host headers are not correctly fix...

OpenProject 安全漏洞

OpenProject is a web-based project management software from OpenProject Open Source. A security vulnerability exists in OpenProject versions prior to 14.3.0. An attacker can exploit this vulnerability to launch a phishing attack against a user account by using a spoofed HOST header in the default...

PT-2024-29568 · Unknown +1 · Openproject +1

Name of the Vulnerable Software and Affected Versions: OpenProject versions prior to 14.3.0 Description: The issue allows an attacker to redirect to a remote host to initiate a phishing attack against an OpenProject user's account by using a forged HOST header in the default configuration of...

CVE-2024-39736

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...

IBM Datacap Navigator 安全漏洞

IBM Datacap Navigator is a Web client for Datacap from International Business Machines IBM. IBM Datacap Navigator suffers from an HTTP header injection vulnerability that originates from an input validation error in the HOST header, which can be exploited by an attacker to conduct cross-site...

PT-2024-4958 · Ibm · Ibm Datacap Navigator

Name of the Vulnerable Software and Affected Versions: IBM Datacap Navigator versions 9.1.5 through 9.1.9 Description: The issue is related to improper validation of input by the HOST headers in HTTP requests, which could allow a remote attacker to conduct various attacks, including cross-site...

Important: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230section-6.7 a server sends 101 wh...

Important: ecs-init

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

PT-2024-9646 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.0 Description: The issue is related to a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that lead to sensitive...

BIT-SUITECRM-2024-36419 SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

CVE-2024-36419

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

CVE-2024-36419

SuiteCRM Core hosts a Host Header Injection vulnerability affecting versions prior to 8.6.1 via direct access to the /legacy route. The issue is addressed in version 8.6.1. The CVE indicates network-level exposure with low impact on confidentiality and integrity and requires no privileges but use...

PT-2024-26986 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 8.6.1 Description: A vulnerability in SuiteCRM allows for Host Header Injection when directly accessing the "/legacy" route. This issue affects versions prior to 8.6.1. Recommendations: For versions prior to 8.6.1,...

SuiteCRM Security Breach

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions prior to 8.6.1 that stems from a host header injection when accessing the /legacy route directly...