PT-2019-15674 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy version 1.12.0 Description: An issue was discovered where an untrusted remote client can send an HTTP header, such as the Host header, with whitespace after the header content. This allows the client to bypass matchers, for example, by...

CVE-2019-18802: Undefined Security Weakness

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header such as Host with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass...

envoy: malformed HTTP request without the Host header may cause abnormal termination of the Envoy process

A flaw was found in envoy. A malformed HTTP request without the Host header may cause abnormal termination of the Envoy process. The highest threat from this vulnerability is to system availability...

CVE-2019-18838

A flaw was found in envoy. A malformed HTTP request without the Host header may cause abnormal termination of the Envoy process. The highest threat from this vulnerability is to system availability...

CVE-2019-17392

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...

CVE-2019-17392

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...

Default credentials

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...

CVE-2019-17392

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection. Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers t...

CVE-2019-17392: Weak Password Recovery Mechanism for Forgotten Password

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...

PT-2019-15125

Name of the Vulnerable Software and Affected Versions Progress Sitefinity version 12.1 Description The issue is related to a weak password recovery mechanism for forgotten passwords. This is due to the mishandling of the HTTP Host header, which can be exploited. Recommendations For Progress...

PT-2019-14977

Name of the Vulnerable Software and Affected Versions TP-LINK TL-WR841N affected versions not specified Description This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the web service,...

CVE-2019-19240

Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak...

Design/Logic Flaw

Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak...

CVE-2019-19240

Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak...

CVE-2019-4216

IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM X-Force ID: 159187...

CVE-2019-4216

IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM X-Force ID: 159187...

Design/Logic Flaw

IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM X-Force ID: 159187...

CVE-2019-4216

CVE-2019-4216 affects IBM Operations Analytics - Log Analysis (formerly SmartCloud/Log Analysis) versions 1.3.1–1.3.5. The vulnerability is a host header injection in HTTP requests, which could lead to HTTP cache poisoning or firewall bypass. The IBM security bulletin confirms the affected versio...

CVE-2019-4216: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM X-Force ID: 159187...