4965 matches found
ok.ru: [okmedia.insideok.ru] Web Cache Poisoing & XSS
XSS and Web Cache Poisoning at .insideok.ru via X-Forwarded-Host header Web Cache Poisoing & XSS okmedia.insideok.ru...
Security Bulletin: IBM StoredIQ is affected by potential Host Header Injection (CVE-2019-4166)
Summary IBM StoredIQ is affected by potential Host Header Injection on StoredIQ Dataserver Vulnerability Details CVEID: CVE-2019-4166 DESCRIPTION: IBM StoredIQ could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a...
PT-2019-9071
Name of the Vulnerable Software and Affected Versions Odoo Community versions 11.0 and earlier Odoo Enterprise versions 11.0 and earlier Description The issue is related to improper Host header sanitization in the dbfilter routing component. This allows a remote attacker to deny access to the...
Ping Identity: Internal Hostname disclosure from multiple Apache servers via blank host header method
This vulnerability was due to a general misconfiguration of Apache servers; this is a good example of the importance of "Secure Defaults" in open-source projects. An example of a generic request and response would be: openssl sclient -connect apache.example.com:443 GET apache.example.com/foo...
Mail.ru: Web Cache Poisoning
Reverse proxy cache poisoning via host header content could lead to stored XSS in uxui.geekbrains.ru...
CVE-2018-1943
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...
Cross site scripting
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...
CVE-2018-1943
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...
PT-2019-9806
Name of the Vulnerable Software and Affected Versions IBM Cloud Private versions 3.1.0 through 3.1.1 Description The issue is caused by improper validation of input, allowing a remote attacker to inject arbitrary HTTP headers by persuading a victim to visit a specially-crafted Web page. This coul...
CVE-2018-1943: Improper Neutralization of Special Elements in Output Used by a Downstream Component
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...
Security Bulletin: IBM Cloud Private is vulnerable to a host header injection attack
Summary IBM Cloud Private is vulnerable to a host header injection attack Vulnerability Details CVEID: CVE-2018-1943 DESCRIPTION: IBM Cloud Private is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a...
CVE-2018-4030
An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...
CVE-2018-4030
An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...
PT-2019-10763
Name of the Vulnerable Software and Affected Versions CUJO Smart Firewall version 7003 Description A vulnerability exists in the safe browsing function, specifically in how it parses HTTP requests. The issue lies in the incorrect extraction of the Host header from captured HTTP requests, allowing...
CVE-2018-4030: Inconsistent Interpretation of HTTP Requests
An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...
PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2019-35826)
PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A cross-site scripting vulnerability exists in the admin/default.php file in PHPMyWind v5.5, which can be exploited by a remote attacker to inject arbitrary Web script or HTML with the help of HTTP...
Design/Logic Flaw
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header...
CVE-2019-8435
CVE-2019-8435 affects PHPMyWind v5.5, with an XSS vulnerability in admin/default.php exploitable via an HTTP Host header. The connected documents confirm the vulnerability and describe the impact as cross-site scripting, enabling arbitrary script/HTML injection when a crafted Host header is proce...
PT-2019-19035
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue is related to an XSS vulnerability via the HTTP Host header in the admin/default.php file. Recommendations For PHPMyWind version 5.5, update the software to a version that includes a fix for this...