3691 matches found
CVE-2019-6146
It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...
CVE-2019-6146
CVE-2019-6146 affects Forcepoint Web Security (version 8.x). The issue is a cross-site scripting (XSS) vulnerability resulting from host header injection in the web application, enabling potential execution of client-side script when a crafted request is processed. The vulnerability is documented...
Host Header Injection
symfony is vulnerable to Host header injection. When an absolute URL is being generated, the function Request::getHost does not validate the user-provided $SERVER'HOST' content in the Host header, allowing an attacker to compromise the web application page with malicious content...
CVE-2019-17147
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Hos...
Protect
A Host Header Redirection vulnerability exists in FortiOS SSL-VPN web portal: when an attacker submits specially crafted HTTP requests, the SSL-VPN web portal may respond with a redirection to websites specified by the attacker...
CVE-2013-4752
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to...
Hardcoded credentials
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to...
Security Bulletin: IBM Operations Analytics - Log Analysis is vulnerable to potential Host Header Injection (CVE-2019-4216)
Summary IBM Operations Analytics - Log Analysis is vulnerable to HTTP header injection, as attacker can abuse the HTTP Host header. Vulnerability Details CVEID: CVE-2019-4216 DESCRIPTION: CVSS Base score: 4.6 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159187 fo...
Envoy Null Pointer Dereference Vulnerability
Envoy is an open source, high performance edge, middle and service agent. A null pointer dereference vulnerability exists in Envoy 1.12.0, which can be exploited to cause an abnormal termination of an Envoy process by sending a malformed HTTP request without a Host header...
Nord Security: Host header injection/redirection | signup and login page
Hey Team. There's a host header injection vulnerability in signup and login page. If possible, the application should avoid incorporating user-controllable data into redirection targets. In many cases, this behavior can be avoided in two ways: Remove the redirection function from the application,...
CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
Null pointer dereference
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
PT-2019-15674 · Envoy +1 · Envoy +1
Name of the Vulnerable Software and Affected Versions: Envoy version 1.12.0 Description: An issue was discovered where an untrusted remote client can send an HTTP header, such as the Host header, with whitespace after the header content. This allows the client to bypass matchers, for example, by...
envoy: malformed HTTP request without the Host header may cause abnormal termination of the Envoy process
A flaw was found in envoy. A malformed HTTP request without the Host header may cause abnormal termination of the Envoy process. The highest threat from this vulnerability is to system availability...
CVE-2019-18838
A flaw was found in envoy. A malformed HTTP request without the Host header may cause abnormal termination of the Envoy process. The highest threat from this vulnerability is to system availability...
CVE-2019-17392
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...