Cross site scripting

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection that allows host header manipulation to redirect pages. The CVE entry notes exploitation is unlikely because the attack would originate from a local machine or an administrator (self-attack). Public exploit references (Exploit-DB/Pack...

Inflection: HTTP Host Header Injection on app.goodhire.com

Researcher reported an issue that was previously reported by a different researcher and subsequently removed from program scope and then requested that we publicly disclose the report after closing it as a duplicate...

GSA Bounty: Subdomain take-over of {REDACTED}.18f.gov

@jackds discovered a number of related subdomain takeover attacks against some subdomains of 18f.gov. Technically, these domains are out of scope for our Vulnerability Disclosure Policy. We want to remind hackers to please limit their testing to domains explicitly listed in that scope which is...

Server side request forgery (ssrf)

In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...

CVE-2017-10973

FineCMS before 2017-07-06 is affected by a server-side request forgery (SSRF) in application/lib/ajax/get_image_data.php, related to processing requests for non-image files with a modified HTTP Host header. Root cause appears to be improper handling of user-controlled Host header leading to unint...

CVE-2016-10073

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

Design/Logic Flaw

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

CVE-2016-10073

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

CVE-2016-10073

Vanilla Forums

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2017-07467)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in versions of MODX Revolution prior to 2.5.7. A remote...

Design/Logic Flaw

In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning...

CVE-2017-9071

In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning...

CVE-2017-9071

MODX Revolution prior to version 2.5.7 is affected by an XSS vulnerability triggered by injecting a payload into the HTTP Host header, as part of a vulnerability chain (often with Cache Poisoning). The affected product is MODX Revolution; the issue is exploitable over the network and requires use...

CVE-2016-6877

Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an...

CVE-2017-7725

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...

CVE-2017-7725

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...

CVE-2017-7725

The CVE concerns concrete5 8.1.0, where the application places incorrect trust in the HTTP Host header during caching when a canonical URL isn’t configured in Advanced Options. A remote attacker can craft a GET with a poisoned Host header, which is stored and can cause certain links shown to subs...

CVE-2016-6285

Cross-site scripting XSS vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header...