489 matches found
CVE-2021-39242
HAProxy contains a vulnerability (CVE-2021-39242) affecting 2.2 prior to 2.2.16, 2.3 prior to 2.3.13, and 2.4 prior to 2.4.3 where mismatch between Host and authority can allow an attacker-controlled HTTP Host header. Reports indicate this could enable manipulation of requests and potential impac...
CVE-2021-39242
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled...
CVE-2021-38751
A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM...
CVE-2021-38751
A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM...
Hardcoded credentials
A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM...
CVE-2021-38751
A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM...
CVE-2021-38751
CVE-2021-38751 describes a host header injection in ExponentCMS 2.6 and earlier, exploitable via the file /exponent_constants.php. A crafted HTTP Host header can cause links on the page to be rewritten to arbitrary values, creating a potential MITM attack vector. The publicly referenced sources (...
CVE-2021-36371
Emissary-Ingress formerly Ambassador API Gateway through 1.13.9 allows attackers to bypass client certificate requirements i.e., mTLS certrequired on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate...
Design/Logic Flaw
Emissary-Ingress formerly Ambassador API Gateway through 1.13.9 allows attackers to bypass client certificate requirements i.e., mTLS certrequired on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate...
CVE-2021-36371
CVE-2021-36371 is reported for Emissary-Ingress (formerly Ambassador API Gateway). The vulnerability allows bypassing client certificate requirements (mTLS cert_required) on backend upstreams when more than one TLSContext exists and any configuration does not require client cert authentication. T...
Machform HTTP Host Header Injection Vulnerability
MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. An HTTP host header injection vulnerability exists in versions prior to Machform 16. The vulnerability stems from improper validation of the host header. An attack...
CVE-2021-20101
Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content...
Design/Logic Flaw
Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content...
CVE-2021-20101
Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content...
Trojan-Dropper.Win32.Googite.a Unauthenticated Open Proxy
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ff30fbee3724d80dcb9471c0b553c99a.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Googite.a Vulnerability: Unauthenticated Open Proxy Description: Googite malwar...
Design/Logic Flaw
Frontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host header, as demonstrated by submitting 127.0.0.1 multiple times for DoS...
CVE-2021-31702
Frontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host header, as demonstrated by submitting 127.0.0.1 multiple times for DoS...
CVE-2021-31702
Frontier ichris versions up to 5.18 are affected by a vulnerability where the application mishandles DNS requests for the hostname supplied in the HTTP Host header, potentially enabling a DoS condition as demonstrated by sending 127.0.0.1 repeatedly. The issue stems from how the DNS request is fo...