Cross site scripting

SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting XSS via the HTTP Host header...

CVE-2021-25179

SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting XSS via the HTTP Host header...

CVE-2021-25179

SolarWinds Serv-U File Server vulnerable to Cross Site Scripting (XSS) via the HTTP Host header in versions before 15.2. The root cause is XSS arising from host header handling. Impact is content integrity/defacement risk on affected deployments; no exploitation details are provided. Remediation:...

SolarWinds Serv-U File Server 跨站脚本漏洞

Solarwinds SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A cross-site scripting vulnerability exists in SolarWinds Serv-U File Server versions prior to 15.2, which originates from exposure to cross-site scripting XSS via the HTTP host header...

DEBIAN-CVE-2021-29462

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp libupnp appears to be vulnerable to DNS rebinding attacks because it does not check the value of the Host header. This can be mitigated by using DNS revolvers which...

CVE-2021-29462

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp libupnp appears to be vulnerable to DNS rebinding attacks because it does not check the value of the Host header. This can be mitigated by using DNS revolvers which...

UBUNTU-CVE-2021-29462

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp libupnp appears to be vulnerable to DNS rebinding attacks because it does not check the value of the Host header. This can be mitigated by using DNS revolvers which...

CVE-2021-29462

The CVE-2021-29462 vulnerability affects the Portable SDK for UPnP Devices (libupnp). The server component fails to validate the Host header, enabling DNS rebinding attacks. Public advisories consistently state the issue is fixed in version 1.14.6 and later. Related OpenVAS/Mageia/Arch Linux entr...

UPnP 数据伪造问题漏洞

UPnP is a Universal Plug and Play protocol from the Open Connectivity Foundation. A data forgery vulnerability exists in Portable SDK version 1.14.6 and later in UPnP Devices because it does not check the value of the "host" header...

GO-2020-0043 Authentication bypass in github.com/mholt/caddy

Due to improper TLS verification when serving traffic for multiple SNIs, an attacker may bypass TLS client authentication by indicating an SNI during the TLS handshake that is different from the name in the HTTP Host header...

VulnCheck KEV: CVE-2021-27101

Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to documentroot.html...

Denial of Service (DoS) in restify-paginate

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

GHSA-QR9H-VR5P-PWWX Denial of Service (DoS) in restify-paginate

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

CVE-2021-30185

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...

CVE-2021-30185

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...

PYSEC-2021-18

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...

Default credentials

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...

CVE-2021-30185

CVE-2021-30185 affects CERN Indico prior to 2.3.4. The vulnerability resides in Indico’s URL generation for password resets, where an attacker-supplied Host header can steer the reset link to an attacker-controlled domain. If a user clicks such a link, the attacker could obtain the password reset...

Adrian indico 安全漏洞

Adrian indico is an application of Adrian open source . A hierarchical content management system. A security vulnerability exists in versions prior to Adrian indico 2.3.4, which stems from the ability to use an attacker-supplied host header in a password reset link...

The vulnerability of the Accellion FTA security system, which stems from the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL code and gain unauthorized access to protected information.

The vulnerability of the Accellion FTA security system lies in the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code and gain unauthorized access to protected information using a specially...