CVE-2025-54588 Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free UAF vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic...

CVE-2024-12973

CVE-2024-12973 describes an Origin Validation Error in Akinsoft OctoCloud that allows HTTP response splitting. Affected versions are s1.09.01 through before v1.11.01; the issue is mitigated by upgrading to v1.11.01 or later. The root cause is improper origin validation that permits crafted HTTP r...

CVE-2024-12973 Host Header Injection in Akinsoft's OctoCloud

Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from s1.09.01 before v1.11.01...

CVE-2024-12973 Host Header Injection in Akinsoft's OctoCloud

Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from s1.09.01 before v1.11.01...

PT-2025-35643

Name of the Vulnerable Software and Affected Versions: Envoy versions 1.34.0 through 1.34.4 Envoy version 1.35.0 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Affected versions contain a use-after-free UAF vulnerabili...

CVE-2024-12925 Host Header Injection in Akinsoft's QR Menu

Improper Validation of Certificate with Host Mismatch vulnerability in Akınsoft QR Menü allows HTTP Response Splitting. This issue affects QR Menü: from s1.05.05 before v1.05.12...

Linux Distros Unpatched Vulnerability : CVE-2024-50305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users ar...

Linux Distros Unpatched Vulnerability : CVE-2018-14774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, a...

CLSA-2025-1756324356 Fix CVE(s): CVE-2025-49630

SECURITY UPDATE: denial of service attack caused by untrusted clients triggering assertion in modproxyhttp2 - debian/patches/CVE-2025-49630.patch: tolerate missing host header in h2 proxy to fix issue with HTTP/0.9 request without Host header - CVE-2025-49630...

Linux Distros Unpatched Vulnerability : CVE-2021-22903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain allowed...

Linux Distros Unpatched Vulnerability : CVE-2016-7965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remot...

Linux Distros Unpatched Vulnerability : CVE-2017-8295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2017-5660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a vulnerability in Apache Traffic Server ATS 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when...

SUSE CVE-2025-7777

The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns...

CVE-2025-7777

The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns...

CVE-2025-7777 Mirror-registry: host header injection in mirror-registry

The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns...

CVE-2025-7777

CVE-2025-7777 concerns a host header sanitation flaw in the mirror-registry that allows an attacker to induce redirects to attacker-controlled domains or phishing hosts. The vulnerability affects the mirror-registry’s handling of the Host header in HTTP requests, with an attack surface implied fo...

CVE-2025-7777 Mirror-registry: host header injection in mirror-registry

The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns...

PT-2025-34038 · Unknown · Mirror-Registry

Name of the Vulnerable Software and Affected Versions: mirror-registry affected versions not specified Description: The mirror-registry does not properly sanitize the host header HTTP header in received HTTP requests, which allows an attacker to perform malicious redirects to attacker-controlled...

Red Hat OpenShift 安全漏洞

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying and running applications. A security vulnerability exists in Red Hat OpenShift that stems from not properly cleaning up the host header in HTTP requests, which...