CVE-2020-25901

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...

CVE-2020-25901

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...

Design/Logic Flaw

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...

CVE-2020-25901

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...

CVE-2020-25901

CVE-2020-25901 affects Spiceworks (v7.5.7.0) via a Host Header Injection in the HTTP handling, enabling an attacker to render arbitrary links to a malicious site using poisoned Host headers. Public references indicate exploitation activity (e.g., Exploit-DB entry for Spiceworks 7.5.7.0 HTTP Heade...

Spiceworks 输入验证错误漏洞

SpiceWorks is a suite of network device management and monitoring software for small and medium-sized businesses from Spiceworks, Inc. An input validation error vulnerability exists in Spiceworks 7.5.7.0, which allows an attacker to render arbitrary links that point to malicious websites with tox...

Thingsboard 注入漏洞

Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in versions prior to ThingsBoard v3.2 that stems from the injection of host headers in password reset emails. This allowed an attacker to...

CVE-2020-12145

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted ...

CVE-2020-28031

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

CVE-2020-28031

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

Design/Logic Flaw

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

CVE-2020-28031

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

CVE-2020-28031

CVE-2020-28031 affects eramba up to version 2.8.1, where HTTP Host header injection is possible. The impact described is that authenticated users can leverage wkhtml2pdf to print PDFs due to this header manipulation. The provided connected sources confirm the vulnerability description but do not ...

Octopus Deploy Input Validation Error Vulnerability

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy versions prior to 2020.4.2 that allows an attacker to redirect users to an external site via a modified HTTP Host...

CVE-2020-26161

In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...

CVE-2020-26161

In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...

Design/Logic Flaw

In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...

CVE-2020-26161

CVE-2020-26161 affects Octopus Deploy up to version 2020.4.2. The vulnerability arises from a flaw where an attacker could cause a user to be redirected to an external site by supplying a modified HTTP Host header. Multiple connected sources corroborate this description (e.g., Red Hat, CNVD, NVD/...

CVE-2020-26161

In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...

python: CRLF injection via the host part of the url passed to urlopen()

A CRLF injection flaw was discovered in python in the way URLs are handled when doing an HTTP/HTTPS connection e.g. through urlopen or HTTPConnection. An attacker who can control the url parameter passed to urlopen method in the urllib/urllib2 modules can inject CRLF sequences and HTTP headers by...