CVE-2018-1896

IBM Connections versions 5.0, 5.5, and 6.0 are described as vulnerable to a host header injection that could cause navigation to the attacker’s domain. The available connected documents consistently identify this as a host header injection issue but do not provide concrete details on affected com...

CVE-2018-1896

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456...

Buffalo TS5600D1206 Access Control Error Vulnerability

The Buffalo TS5600D1206 is a network storage device from the Buffalo Group of Japan. An access control error vulnerability exists in the nasapi in the Buffalo TS5600D1206 version 3.61-0.10, which can be exploited by an attacker to bypass authentication by sending a modified HTTP Host packet heade...

CVE-2018-13324

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

Authentication flaw

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

Unspecified Vulnerability in Green Electronics RainMachine Mini-8 and Touch HD 12 Web Applications (CNVD-2019-28247)

Green Electronics RainMachine Mini-8 and Touch HD 12 Web Application are both products of American c. Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler. touch HD 12 Web Touch HD 12 Web Application is a web-based touch screen application. A security vulnerability exists in the...

Jelastic 5.4 - host SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Jelastic 5.4 - 'host' SQL injection Exploit Author: Procode701 Vendor Homepage: https://jelastic.com/ Software Link: https://jelastic.com/ Version: 5.4 Tested on: Kali Linux CVE : N/A POC: The application...

Jelastic 5.4 SQL Injection

Exploit Title: Jelastic 5.4 - 'host' SQL injection Google Dork: N/A Date: date Exploit Author: Procode701 Vendor Homepage: https://jelastic.com/ Software Link: https://jelastic.com/ Version: 5.4 Tested on: Kali Linux CVE : N/A POC: The application /1.0/users/authentication/rest/signin is vulnerab...

Jelastic 5.4 - 'host' SQL Injection

Exploit Title: Jelastic 5.4 - 'host' SQL injection Google Dork: N/A Date: date Exploit Author: Procode701 Vendor Homepage: https://jelastic.com/ Software Link: https://jelastic.com/ Version: 5.4 Tested on: Kali Linux CVE : N/A POC: The application /1.0/users/authentication/rest/signin is vulnerab...

CVE-2018-6908

An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application allowing an unauthenticated attacker to perform authenticated actions on the device via a 127.0.0.1:port value in the HTTP 'Host' header, as demonstrated by...

Authentication flaw

An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application allowing an unauthenticated attacker to perform authenticated actions on the device via a 127.0.0.1:port value in the HTTP 'Host' header, as demonstrated by...

CVE-2018-6908

An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application allowing an unauthenticated attacker to perform authenticated actions on the device via a 127.0.0.1:port value in the HTTP 'Host' header, as demonstrated by...

The vulnerability of the FortiOS operating system arises from insufficient protection of the web page structure, allowing attackers to inject arbitrary JavaScript or HTML code.

The vulnerability of the FortiOS operating system arises from insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code using a specially crafted HTTP request header named “Host”...

CVE-2018-18789

An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php...

CVE-2018-18789

An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php...

Mozilla Firefox WebExtension Domain Restriction Bypass Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox versions prior to 63 and Firefox ESR versions prior to 60.3. A remote attacker can exploit this...

Mozilla: WebExtension bypass of domain restrictions through header rewriting

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR 60.3 and Firefox 63...

nodejs: Inspector DNS rebinding vulnerability

It was found that when a Node.js script is run in inspector mode, Node.js did not properly validate the Host header, leaving the inspector vulnerable to a DNS rebind attack and bypass same-origin policy. If a developer had an inspector session running, and was visiting a malicious website, the si...

CVE-2018-12472

A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: versions prior to 3.0.37...

xunfeng anti-csrf decorator cross-site request forgery vulnerability

xunfeng is a vulnerability rapid response and asset scanning system for enterprise intranets. anti-csrf decorator is one of the CSRF processing components. The anti-csrf decorator in xunfeng version 0.2.0 has a cross-site request forgery vulnerability that originates from the views/lib/AntiCSRF.p...