CVE-2023-0100

In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter e.g. report=http://xyz.com/report.rptdesign. If the host indicated in the report parameter matched the HTTP Host header valu...

Eclipse BIRT 安全漏洞

Eclipse BIRT is a suite of open source software from the Eclipse Foundation that provides reporting and business intelligence capabilities for rich client applications and web applications. A security vulnerability exists in Eclipse BIRT versions prior to 4.13 that stems from a default...

PT-2023-2201 · Eclipse · Eclipse Birt

Name of the Vulnerable Software and Affected Versions: Eclipse BIRT versions 2.6.2 through 4.12 Description: The issue is related to insufficient input validation when processing host headers with the report parameter. This could allow a remote attacker to gain unauthorized access to protected...

PT-2023-13564 · Hewlett Packard · Hpe Flexfabric 5700 Switch Series

Name of the Vulnerable Software and Affected Versions: HPE FlexFabric 5700 Switch Series versions prior to R2432P61 Description: The issue concerns potential security vulnerabilities in the HPE FlexFabric 5700 Switch Series, which could be remotely exploited to allow host header injection and URL...

CVE-2023-24975

IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID...

IBM Spectrum Symphony 输入验证错误漏洞

IBM Spectrum Symphony is a high performance computing software system from International Business Machines IBM. A security vulnerability exists in IBM Spectrum Symphony version 7.3, which stems from incorrect validation of user input in the HOST header...

HPESBNW04398 rev.1 - HPE FlexFabric 5700 Switches, Multiple Vulnerabilities

Potential Security Impact: Remote: URL Redirection, Host Header Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE FlexFabric 5700 Switch Series - Prior to R2432P61 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2022-37940 |...

Security Bulletin: IBM Spectrum Symphony is vulnerable to Host header injection

Summary IBM Spectrum Symphony 7.3.0 can encounter an unauthenticated Host header injection vulnerability. Vulnerability Details CVEID:CVE-2023-24975 DESCRIPTION: IBM Spectrum Symphony is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could...

CVE-2023-24975 IBM Spectrum Symphony HOST header injection

IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID...

Updated python-twisted packages fix security vulnerability

When the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. CVE-2022-39348...

MGASA-2023-0061 Updated python-twisted packages fix security vulnerability

When the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. CVE-2022-39348...

CRLF Injection in Nodejs ‘undici’ via host

...

SUSE CVE-2023-23936

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to...

The vulnerability of the IBM Sterling Secure Proxy proxy server, related to insufficient validation of input data, allows attackers to perform cross-site scripting attacks.

The vulnerability of the IBM Sterling Secure Proxy proxy server is related to insufficient validation of input data when processing HOST headers. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Vulnerabilities fixed in Node.js

Vulnerabilities have been fixed in node.js. A malicious party can exploit the vulnerabilities to bypass security measures and thus gain access to modules and code for which which it is not authorized. Also, the malicious party can cause a Denial-of-Service, or through host header injection...

CVE-2022-36775 IBM Security Verify Access HOST header injection

IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting,...

PT-2023-13497 · Ibm · Ibm Security Verify Access

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0.0 through 10.0.4.0 Description: The issue is caused by improper validation of input by the HOST headers, leading to HTTP header injection. This could allow an attacker to conduct various attacks...

DEBIAN-CVE-2023-23936

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to...

AZL-13604 CVE-2023-23936 affecting package nodejs for versions less than 16.19.1-1

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to...

ALPINE-CVE-2023-23936

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to...