Important: runc

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Important: runc

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Important: golang

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Important: nerdctl

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...

Important: cri-tools

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20-openssl (SUSE-SU-2023:3002-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3002-1 advisory. Update to version 1.20.6.1 bsc1206346: - CVE-2023-29406: Fixed insufficient sanitization of Host header...

Golang < 1.19.11 / 1.20.x < 1.20.6 Security Bypass

The version of Golang Go installed on the remote host is affected by security bypass vulnerability. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuse...

CVE-2022-31458

RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning...

CVE-2022-31458

RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning...

CVE-2022-31458

RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning...

CVE-2022-31458

RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning...

RTX 安全漏洞

RTX is RTXteam's prototype translation reasoning tool. A security vulnerability exists in RTX TRAP v1.0. An attacker can spoof the server by manipulating the host header field in an HTTP request, causing the server to process the request with a malicious hostname...

CVE-2022-31458

CVE-2022-31458 affects RTX TRAP v1.0, with a host header poisoning vulnerability. Exploitation involves manipulating the HTTP Host header to spoof the server and cause it to process requests under a malicious hostname. Reported data from NVD cites a network attack vector with low-moderate impact ...

PT-2023-13041 · Rtx Trap · Rtx Trap

Name of the Vulnerable Software and Affected Versions: RTX TRAP version 1.0 Description: The issue is related to host header poisoning. Recommendations: For RTX TRAP version 1.0, consider restricting access to vulnerable endpoints to minimize the risk of exploitation. At the moment, there is no...

CVE-2022-31458

RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning...

CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

DEBIAN-CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

Input validation

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...