CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

UBUNTU-CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

CVE-2016-9028

Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header...

Design/Logic Flaw

Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header...

CVE-2016-9028

The CVE-2016-9028 issue affects Citrix NetScaler ADC (various 10.x/11.x builds) and enables an unauthenticated, remote attacker to steal session cookies by manipulating the Host header in an unauthorized redirect flow. Affected versions include 10.1 <135.8, 10.5 <61.11, 11.0 <65.31/65.35...

CVE-2016-9028

Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header...

RubyGems: Host Header Injection/Redirection

rubygems.org is vulnerable to host header injection because the host header can be changed to something outside the target domain. Attack vectors are somewhat limited but depends on how the host header is used by the back-end application code. If code references the hostname used in the URL such ...

New Relic: HOST HEADER INJECTION in rpm.newrelic.com

hello to all professionals Greetings i have found a host header injection vulnerability in your website vulnerable url :- rpm.newrelic.com the host header can be changed to something outside the target domain In many cases, developers are trusting the HTTP Host header value and using it to genera...

Boozt Fashion AB: Host header poisoning leads to account password reset links hijacking

Hi, Issue Summary : While conducting my regular testing I discovered that the mobile version of boozt.com application relies on the host header when constructing password reset links emailed to the user. Thus, an attacker can inject a arbitrary host header which leads to password reset leakage...

IBM Connections Host Header Injection Vulnerability

IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A host header injectio...

Gratipay: Host Header poisoning on gratipay.com

There is a host header poisoning vulnerability on gratipay.com that allows an attacker to cause a 301 redirect and poison the browser DNS cache to cause all further requests to gratipay.com to be redirected to the attacker's site. PoC Request: GET https://gratipay.com/ HTTP/1.1 Host: heroku.com...

Instacart: Host Header Injection/Redirection in: https://www.instacart.com/

Hi, Your website is vulnerable to Host Header Injection because the host header can be changed to something outside the target domain In many cases, developers are trusting the HTTP Host header value and using it to generate links, import scripts and even generate password resets links with its...

Gratipay: Host Header Injection/Redirection Attack

Hello, I'm sorry for adding this, please allow me to close if you do not accept the risk involved. Gratipay is vulnerable to host header injection because the host header can be changed to something outside the target domain ie. gratipay.com and grtp.co and cause it to redirect to to that domain...

XSS in /includes/decorators/global-translations.jsp

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-61888. panel Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce: Tamper with a GET request to...

The vulnerability of the Firefox browser, which allows a remote attacker to bypass certificate verification

The vulnerability of the Firefox browser in handling alternative HTTP services allows a malicious actor to bypass the X.509 certificate verification for SSL servers by modifying the server address in the uri-host header of the HTTP/2 response...

Nextcloud: Log pollution can lead to HTML Injection.

Hi Team, I was looking around in your app and on the log part accessed by the admin, I noticed that the log file is downloaded as an HTML file. Naturally I started trying to inject code I noticed that when HTML code is inserted, a HTML comment start tag is inserted. But I was able to bypass this...

Squid Squoison Host Header Cache Poisoning (CVE-2016-4553)

A cache poisoning vulnerability exists in Squid proxy when configured as a transparent proxy. The flaw is caused by improper inspection of the Host header against the URI in the HTTP request line. An attacker can exploit this flaw by sending a crafted request to some website through the proxy...

USN-2995-1 squid3 vulnerabilities

Yuriy M. Kaminskiy discovered that the Squid pinger utility incorrectly handled certain ICMPv6 packets. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly cause Squid to leak information into log files. CVE-2016-3947 Yuriy M. Kaminskiy...

squid: Header Smuggling issue in HTTP Request processing

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...