543 matches found
CVE-2008-6171
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header...
YzmCMS HTTP Host Header Injection Vulnerability
YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 5.3 HTTP host header injection vulnerability. Attackers can use this vulnerability to Web cache poisoning or trigger redirection...
CVE-2019-16532: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections...
PT-2019-14735
Name of the Vulnerable Software and Affected Versions Embedthis GoAhead version 2.5.0 Description An issue was discovered where certain pages, such as "goform/login" and "config/log off page.htm", create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker...
CVE-2019-16645: Improper Control of Generation of Code
An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages such as goform/login and config/logoffpage.htm create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack...
Cross site scripting
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...
CVE-2018-1943
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...
CVE-2018-1943: Improper Neutralization of Special Elements in Output Used by a Downstream Component
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...
PT-2019-9806
Name of the Vulnerable Software and Affected Versions IBM Cloud Private versions 3.1.0 through 3.1.1 Description The issue is caused by improper validation of input, allowing a remote attacker to inject arbitrary HTTP headers by persuading a victim to visit a specially-crafted Web page. This coul...
CVE-2018-4030: Inconsistent Interpretation of HTTP Requests
An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...
PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2019-35826)
PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A cross-site scripting vulnerability exists in the admin/default.php file in PHPMyWind v5.5, which can be exploited by a remote attacker to inject arbitrary Web script or HTML with the help of HTTP...
Design/Logic Flaw
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header...
CVE-2019-8435
CVE-2019-8435 affects PHPMyWind v5.5, with an XSS vulnerability in admin/default.php exploitable via an HTTP Host header. The connected documents confirm the vulnerability and describe the impact as cross-site scripting, enabling arbitrary script/HTML injection when a crafted Host header is proce...
PT-2019-19035
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue is related to an XSS vulnerability via the HTTP Host header in the admin/default.php file. Recommendations For PHPMyWind version 5.5, update the software to a version that includes a fix for this...
CVE-2019-8435: Improper Neutralization of Input During Web Page Generation
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header...
Cross site scripting
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...
CVE-2018-2504
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...
PT-2018-3538
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java Web Container service versions prior to 7.10 SAP NetWeaver AS Java Web Container service versions prior to 7.11 SAP NetWeaver AS Java Web Container service versions prior to 7.20 SAP NetWeaver AS Java Web Container servi...
CVE-2018-2504: Improper Neutralization of Input During Web Page Generation
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...