CVE-2019-16532

CVE-2019-16532 describes an HTTP Host header injection vulnerability in YzmCMS 5.3. Multiple connected sources (Red Hat, CNVD, NVD, OSV, CVE listings) confirm that an attacker can abuse the Host header to poison caches or trigger redirections. The core issue is a Host header handling flaw in YzmC...

YzmCMS 5.3 Host Header Injection

Exploit Title: YzmCMS 5.3 - 'Host' Header Injection Exploit Author: Debashis Pal Vendor Homepage: http://www.yzmcms.com/ Source: https://github.com/yzmcms/yzmcms Version: YzmCMS V5.3 CVE : N/A Tested on: Windows 7 SP164bit,XAMPP: 7.3.9 About YzmCMS ============== YzmCMS is a lightweight open sour...

CVE-2019-16645

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages such as goform/login and config/logoffpage.htm create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

CVE-2019-4186

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

PT-2019-16957 · Ibm · Ibm Jazz For Service Management

Name of the Vulnerable Software and Affected Versions: IBM Jazz for Service Management version 1.1.3 Description: The issue is caused by incorrect trust in the HTTP Host header during caching, allowing a remote attacker to inject arbitrary HTTP headers by sending a specially crafted HTTP GET...

Host Header Injection

invenio-app is vulnerable to host header injection. The attack exists because it only relies on APPALLOWEDHOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header...

SQL Injection Vulnerability in zzcms HOST Header

ZZCMS with product investment type template, you can quickly build product investment website. zzcms HOST header SQL injection vulnerability, attackers can use the vulnerability to obtain database information...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

Design/Logic Flaw

invenio-app before 1.1.1 allows host header injection...

PYSEC-2019-24

invenio-app before 1.1.1 allows host header injection...

CVE-2019-1020006

CVE-2019-1020006 affects invenio-app prior to 1.1.1 and allows host header injection due to insufficient validation of host headers via APP_ALLOWED_HOSTS. Multiple sources corroborate a host header injection risk in Invenio-App before the patched versions. The Red Hat advisory reiterates the same...

GHSA-94MF-XFG5-R247 Invenio-App vulnerable to host header injection attack

APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2...

Invenio-App vulnerable to host header injection attack

APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2...

JamieWeb: HTTP Request Smuggling

is vulnerable to host header injection because the host header can be changed to something outside the target domain. Attack vectors are somewhat limited but depends on how the host header is used by the back-end application code. If code references the hostname used in the URL such as password...

CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilities

Exploit Title: CISCO Small Business 200, 300, 500 Switches Multiple Vulnerabilities. Shodan query: /config/logoffpage.html Discovered Date: 07/03/2014 Reported Date: 08/04/2019 Exploit Author: Ramikan Website: http://fact-in-hack.blogspot.com Vendor...

CVE-2018-14887

Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request...

CVE-2018-14887

Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request...

CVE-2018-14887

Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request...

CVE-2018-14887

Technical details about CVE-2018-14887 are not publicly provided in the connected documents. The materials include the description of improper Host header sanitization in Odoo 11.x but lack specifics on affected versions, vulnerable components, or available fixes.