PullString: Host Header Injection and Cache Poisoning

The website toytalk.com is vulnerable to host header injection. Whenever i change the host to something like google.com, it is getting redirected to google.com. Steps To Reproduce: 1 While navigating to toytalk.com intercept the request and change the host to google.com. 2 you will see that you a...

Starbucks: Host header injection/redirection via newsletter signup

Good evening, There's a host header injection vulnerability via all newsletter signups in the referrer attribute. This works with all pages that have "Join our email list" signup boxes. Since the referrer attribute can be changed to an outside domain the email being received redirects all links...

0-Day Flaws in Vanilla Forums Let Remote Attackers Hack Websites

A security researcher has publicly disclosed two critical zero-day vulnerabilities in Vanilla Forums, an open source software that powers discussion on over 500,000 websites, which could allow unauthenticated, remote attackers to fully compromise targeted websites easily. Discovered by Polish...

Vanilla Forums Open Source Software Vulnerable to RCE, Host Header Injection Vulnerability

Popular open source forum software suffers from vulnerabilities that could let an attacker gain access to user accounts, carry out web-cache poisoning attacks, and in some instances, execute arbitrary code. Legal Hackers‘ Dawid Golunski found the vulnerabilities–a host header injection and an...

WordPress 2.3-4.8.3 - Host Header Injection in Password Reset

Description Attacker may be able to set the 'From' email header in password reset emails. PoC curl -H "Host: www.evil.com" --data "userlogin=adminto=&wp-submit;=Get+New+Password" http://example.com/wp-login.php?action=lostpassword...

Homebrew: Host header Injection

HI SECURITY TEAM Here is host header injection. Request changing host to www.google.com GET / HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 Windows NT 6.1; rv:24.0 Gecko/20100101 Firefox/24.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language:...

concrete5 Host Header Injection Vulnerability

concrete5 is a free content management system CMS developed by Portland Labs in the United States. A Host header injection vulnerability exists in concrete5, which allows an attacker to inject a malicious ip or domain name by modifying the Host header...

Concrete5 8.1.0 - Host Header Injection Vulnerability

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ================== www.concrete5.org Product: ================ concrete5 v8.1.0 concrete5 is an open-source content management system CMS for publishing content on the World Wide Web and intranets...

Concrete5 CMS 8.1.0 - Host Header Injection

Concrete5 CMS 8.1.0 - Host Header Injection + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt + ISR: ApparitionSec Vendor: ================== www.concrete5.org Product:...

Concrete5 CMS 8.1.0 - 'Host' Header Injection

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt + ISR: ApparitionSec Vendor: ================== www.concrete5.org Product: ================ concrete5 v8.1.0 concrete5 is an...

concrete5 8.1.0 Host Header Injection

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt + ISR: ApparitionSec Vendor: ================== www.concrete5.org Product: ================ concrete5 v8.1.0 concrete5 is an...

Design/Logic Flaw

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

CVE-2016-5933

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

CVE-2016-5933

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

CVE-2016-5933

IBM Tivoli Monitoring Basic Services Vulnerability (CVE-2016-5933) affects IBM Tivoli Monitoring with the Firewall Gateway feature activated. The issue is a host header injection that could lead to HTTP cache poisoning or firewall bypass. Affected releases include IBM Tivoli Monitoring 6.2.x and ...

CVE-2016-5933

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

DEBIAN-CVE-2017-6508

CRLF injection vulnerability in the urlparse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL...

CVE-2016-0310

IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain...

CVE-2016-0310

IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain...

CVE-2016-0310

CVE-2016-0310 affects IBM Connections 5.5 and earlier. The vulnerability is a host header injection flaw that can cause navigation to the attacker’s domain. Root cause noted in CNVD records: the program fails to properly validate HTTP request headers, enabling manipulation via the Host header. Ex...