CVE-2011-4140

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page...

CVE-2011-4139

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...

CVE-2010-4714

Multiple stack-based buffer overflows in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long HTTP Host header to 1 gwpoa.exe in the Post Office Agent, 2 gwmta.exe in the Message Transfer Agent, 3 gwia.exe in the Internet Agent, 4 the WebAccess Agent, or 5 th...

Mozilla Fixes Site Error-Handling Bug

Mozilla has fixed a bug in the way that its Bugzilla Web site and others handled certain errors, which could have been exploited to execute a man-in-the-middle attack against an unsuspecting user. The bug was related to the way that the sites responded to certain requests from client machines whe...

Lokomedia CMS File Disclosure

Title : Local File Disclosure Vulnerability Lokomedia CMS sukaCMS + Vendor : http://bukulokomedia.com + Discovered : vir0e5 a.k.a banditc0de + Contact : vir0e5athackermaildotcom + Site : http://vir0e5.blogspot.com + DorK : inurl:/downlot.php?file= + Exploit :...

CVE-2009-4177

Buffer overflow in webappmon.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header...

Stack overflow

Stack-based buffer overflow in snmpviewer.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header...

Buffer overflow

Buffer overflow in webappmon.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header...

CVE-2009-4177

Buffer overflow in webappmon.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header...

WordPress RSS feed Generator self_link HTTP_HOST Cross-Site Scripting (CVE-2008-5278)

WordPress is an opensource php-based blog publishing platform. It offers several features such as multi-author editing capability, automatic formatting of text and an architecture which supports plugins to further extend its functionality. There exists a cross-site script insertion vulnerability ...

Google Chrome < 1.0.154.53 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is earlier than 1.0.154.53. Such versions are reportedly affected by multiple vulnerabilities : - The browser uses the HTTP Host header to determine the context of a 4xx/5xx CONNECT response from a proxy server. This could allow a...

CVE-2009-2058

Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack...

CVE-2009-2059

Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" atta...

CVE-2009-2060

src/net/http/httptransactionwinhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this...

CVE-2009-2057

Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL...

Hardcoded credentials

Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" atta...

Hardcoded credentials

Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL...

CVE-2009-2059

Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" atta...

CVE-2009-2058

Apple Safari before 3.2.2 is affected by CVE-2009-2058 where the HTTP Host header is used to determine the document context in a (1) 4xx or (2) 5xx CONNECT response from a proxy, enabling a man-in-the-middle to modify the response and execute arbitrary web scripts (SSL-tampering). Connected sourc...

CVE-2009-2057

Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL...