CVE-2021-27391

A vulnerability has been identified in APOGEE MBC PPC P2 Ethernet All versions = V2.6.3, APOGEE MEC PPC P2 Ethernet All versions = V2.6.3, APOGEE PXC Compact BACnet All versions = V2.8, APOGEE PXC Modular BACnet All versions = V2.8, TALON TC Compact BACnet All versions V3.5.3, TALON TC Modular...

CVE-2021-27391: Buffer Copy without Checking Size of Input

A vulnerability has been identified in APOGEE MBC PPC P2 Ethernet All versions = V2.6.3, APOGEE MEC PPC P2 Ethernet All versions = V2.6.3, APOGEE PXC Compact BACnet All versions = V2.8, APOGEE PXC Modular BACnet All versions = V2.8, TALON TC Compact BACnet All versions V3.5.3, TALON TC Modular...

PT-2021-4188

Name of the Vulnerable Software and Affected Versions APOGEE MBC PPC P2 Ethernet versions V2.6.3 and later APOGEE MEC PPC P2 Ethernet versions V2.6.3 and later APOGEE PXC Compact BACnet versions prior to V3.5.3 APOGEE PXC Compact P2 Ethernet versions V2.8 and later APOGEE PXC Modular BACnet...

CVE-2020-22002: Server-Side Request Forgery (SSRF)

An Unauthenticated Server-Side Request Forgery SSRF vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI =6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Sinc...

PT-2021-10717

Name of the Vulnerable Software and Affected Versions Inim Electronics Smartliving SmartLAN/G/SI versions prior to 7.x Description An Unauthenticated Server-Side Request Forgery SSRF issue exists within the GetImage functionality. The application uses user-supplied data in the host parameter to...

Knowage 跨站脚本漏洞

Knowage is a suite of open source tools for modern business analytics. A cross-site scripting vulnerability exists in Knowage versions prior to 7.4, which can be exploited by an attacker to inject arbitrary external scripts in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBIHOST'...

Cross-site Scripting (XSS)

locust is vulnerable to cross-site scripting XSS. An attacker can inject and execute malicious script in a user's browser via the host parameter through the web UI...

squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour

A flaw was found in squid. Squid, when certain web browsers are used, mishandles HTML in the host parameter to cachemgr.cgi which could result in squid behaving in unsecure way...

CVE-2018-21268: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The traceroute aka node-traceroute package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character...

PT-2020-8911

Name of the Vulnerable Software and Affected Versions traceroute aka node-traceroute versions through 1.0.0 Description The issue allows remote command injection via the host parameter. This occurs because the Child.exec method is used, which is considered not entirely safe. An OS command can be...

DEBIAN-CVE-2019-18860

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

UBUNTU-CVE-2019-18860

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

CVE-2019-18860

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

CVE-2019-18860

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

PT-2020-5788

Name of the Vulnerable Software and Affected Versions Squid versions prior to 4.9 Squid versions 4.6 through 4.6-1+deb10u3 Squid versions 3.5.23-5+deb9u2 and earlier Squid version 4.10-alt1 Squid versions 4.16-1.5 Description Squid, a high-performance proxy caching server, is affected by multiple...

CVE-2019-19943: Double Free

The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parameter. It may be possible to achieve remote code execution because of a double free...

PT-2020-10301

Name of the Vulnerable Software and Affected Versions Pablo Quick 'n Easy Web Server version 3.3.8 Description The issue concerns a Remote Unauthenticated Heap Memory Corruption in the HTTP service of the affected software. This corruption can occur via a large host or domain parameter. It is...

CVE-2019-20139

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...

UBUNTU-CVE-2019-18348

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...

Arbitrary Code Execution

The Redis command line tool 'redis-cli' is vulnerable to arbitrary code execution through the -h host command line parameter which allows an attacker to achieve code execution and escalate to higher privileges...