UBUNTU-CVE-2021-29462

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp libupnp appears to be vulnerable to DNS rebinding attacks because it does not check the value of the Host header. This can be mitigated by using DNS revolvers which...

CVE-2021-29462

The CVE-2021-29462 vulnerability affects the Portable SDK for UPnP Devices (libupnp). The server component fails to validate the Host header, enabling DNS rebinding attacks. Public advisories consistently state the issue is fixed in version 1.14.6 and later. Related OpenVAS/Mageia/Arch Linux entr...

UPnP 数据伪造问题漏洞

UPnP is a Universal Plug and Play protocol from the Open Connectivity Foundation. A data forgery vulnerability exists in Portable SDK version 1.14.6 and later in UPnP Devices because it does not check the value of the "host" header...

GO-2020-0043 Authentication bypass in github.com/mholt/caddy

Due to improper TLS verification when serving traffic for multiple SNIs, an attacker may bypass TLS client authentication by indicating an SNI during the TLS handshake that is different from the name in the HTTP Host header...

VulnCheck KEV: CVE-2021-27101

Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to documentroot.html...

GHSA-QR9H-VR5P-PWWX Denial of Service (DoS) in restify-paginate

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

Denial of Service (DoS) in restify-paginate

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

CVE-2021-30185

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...

Default credentials

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...

PYSEC-2021-18

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...

CVE-2021-30185

CVE-2021-30185 affects CERN Indico prior to 2.3.4. The vulnerability resides in Indico’s URL generation for password resets, where an attacker-supplied Host header can steer the reset link to an attacker-controlled domain. If a user clicks such a link, the attacker could obtain the password reset...

Adrian indico 安全漏洞

Adrian indico is an application of Adrian open source . A hierarchical content management system. A security vulnerability exists in versions prior to Adrian indico 2.3.4, which stems from the ability to use an attacker-supplied host header in a password reset link...

The vulnerability of the Accellion FTA security system, which stems from the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL code and gain unauthorized access to protected information.

The vulnerability of the Accellion FTA security system lies in the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code and gain unauthorized access to protected information using a specially...

CVE-2021-23000

On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may...

DEBIAN-CVE-2021-20213

A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed...

ALPINE-CVE-2021-20213

A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed...

CVE-2021-20213

A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed...

CVE-2021-20213

A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed...

Unnamed Vulnerability in October CMS

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. October before version 1.1.2 suffers from a security vulnerability that stems from a host header attack that may succeed when running on a misconfigured server. No detailed vulnerabilit...

Host-Header Injection

october/october is vulnerable to host-header injection. The server is configured to accept a wildcard as a hostname and routes the requests regardless of the Host header value. This potentially allows for Host Header injection attacks to succeed and can cause unexpected behavior in the applicatio...