33 matches found
USN-1632-1: Django vulnerability
James Kettle discovered Django did not properly filter the Host HTTP header when processing certain requests. An attacker could exploit this to generate and display arbitrary URLs to users...
CVE-2012-3829
Affected product: Joomla! 2.5.3. Vulnerability: exposes the installation path to remote attackers via the Host HTTP header, enabling information disclosure. Root cause: improper handling of the Host header leading to path disclosure. Impact: partial confidentiality breach (installation path expos...
CVE-2012-3828
CVE-2012-3828 affects Joomla! 2.5.3 with a cross-site scripting (XSS) vulnerability exploitable via the Host HTTP Header, allowing remote script/HTML injection. Root cause described as insufficient validation of the Host header. Impact is client-side script execution potential; no explicit exploi...
CVE-2012-3828
Cross-site scripting XSS vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header...
Design/Logic Flaw
DISPUTED McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details for the...
CVE-2012-2213
Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and...
CVE-2012-2212
CVE-2012-2212 affects McAfee Web Gateway 7.0. The issue arises when the appliance bypasses the access configuration for the CONNECT method based on the Host header, allowing an arbitrary allowed hostname to bypass URL filtering. Public Red Hat/RedHat-like entries corroborate the behavior and note...
CVE-2012-2213
CVE-2012-2213 affects Squid 3.1.9. The issue allows remote attackers to bypass access control for the CONNECT method by supplying an arbitrary hostname in the Host HTTP header, enabling potential access to blocked sites via SSL. The core cause is host header-based ACL evaluation in the CONNECT ha...
Cross site scripting
Cross-site scripting XSS vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances ASA 5520 with software 7.2430 and earlier 7.2 versions including 7.2222, and 8.0428 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject...
CVE-2005-1391
Buffer overflow in the addport function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header...
CVE-2005-1391
Buffer overflow in the addport function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header...
