CVE-2016-2049

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

PT-2016-4988

Name of the Vulnerable Software and Affected Versions JanRain PHP OpenID library aka php-openid affected versions not specified Description The issue is related to improper checking of the openid.realm parameter against the SERVER NAME element in the SERVER superglobal array. This might allow...

CVE-2016-2049: Improper Access Control

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

DEBIAN-CVE-2016-1983

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

CVE-2016-1983

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

CVE-2016-1983

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

UBUNTU-CVE-2016-1983

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

CVE-2016-1983

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

CVE-2016-1983

CVE-2016-1983 affects Privoxy; the vulnerability lies in the client_host function in parsers.c, where receiving an empty HTTP Host header can trigger a denial-of-service via an invalid read and crash. Affected versions are Privoxy prior to 3.0.24. Public advisories and updates (e.g., Debian DSA-3...

CVE-2016-1983

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

PT-2016-4942

Name of the Vulnerable Software and Affected Versions Privoxy versions prior to 3.0.24 Description The issue allows remote attackers to cause a denial of service, resulting in an invalid read and crash, by sending an empty HTTP Host header. This is due to a problem in the client host function in...

CVE-2016-1983: Improper Input Validation

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

Whisper: Host Header Injection/Redirection

whisper.sh is vulnerable to host header injection because the host header can be changed to something outside the target domain ie. whisper.sh and cause it to redirect to to that domain instead see below. Attack vectors are somewhat limited but depends on how the host header is used by the back-e...

HTTP Host Header Injection Detection

Checks if the host is vulnerable to Host header injection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Host Header Injection Detection', 'Description' = 'Checks if the host is vulnerabl...

Mantis Bug Tracker 1.2.19 - Host Header

Mantis Bug Tracker 1.2.19 - Host Header Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability Date: 07-09-2015 Exploit Author: Pier-Luc Maltais Centre opérationnel de sécurité informatique gouvernemental COSIG Vendor Homepage: https://www.mantisbt.org/ Software Link:...

Mantis Bug Tracker 1.2.19 - Host Header

Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability Date: 07-09-2015 Exploit Author: Pier-Luc Maltais Centre opérationnel de sécurité informatique gouvernemental COSIG Vendor Homepage: https://www.mantisbt.org/ Software Link:...

4images 1.7.11 File Inclusion

| Title : 4images 1.7.11 Multi Vulnerability | Author : indoushka | email : [email protected] | Dork : Powered by 4images 1.7.11 | Tested on: windows 8.1 Français V.Pro | Download : http://www.4homepages.de/ ======================================= Host Header Attack : Vulnerability...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Security: Added HTTP "Host" header character validation to prevent cache poisoning attacks when baseurl auto-detection is used. Security: Added FSCommand and seekSegmentTime to the "evil attributes" list in CISecurity::xssclean...

Mozilla Firefox Man-in-the-Middle Attack Vulnerability

Mozilla Firefox is a web browser developed by the Mozilla Foundation in conjunction with the open source community. A security vulnerability in the Mozilla Firefox HTTP Alternative Services feature allows attackers to bypass SSL services and conduct man-in-the-middle attacks by specifying a...

CVE-2014-9182

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header...