CVE-2009-2057

Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL...

CVE-2009-2060

Google Chrome before 1.0.154.53 is affected by an SSL/tampering flaw: the browser uses the HTTP Host header to determine the context of a 4xx/5xx CONNECT response from a proxy, enabling a man-in-the-middle to run arbitrary script in the context of a legitimate server. This is described in CVE-200...

Hardcoded credentials

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying...

CVE-2009-1836

CVE-2009-1836: The vulnerability arises from how Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17) use the HTTP Host header to determine the document context in a non-200 CONNECT response from a proxy. This can enable a man-in-the-middle attacker to modify the C...

CVE-2009-1836

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying...

Code injection

Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow 1 remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking...

CVE-2009-1677

Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow 1 remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking...

Safari < 3.2.3 Multiple Vulnerabilities

The version of Safari installed on the remote Windows host is earlier than 3.2.3. Such versions are potentially affected by several issues : - A heap-based buffer overflow issue in the libxml library when handling long entity names could lead to a crash or arbitrary code execution. CVE-2008-3529 ...

Design/Logic Flaw

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks...

CVE-2009-0164

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks...

CVE-2009-0164

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks...

CVE-2009-0164

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks...

CVE-2009-0164

CVE-2009-0164 affects the CUPS web interface prior to 1.3.10, where the HTTP Host header is not validated. This enables DNS rebinding-style attacks from a remote attacker over the network (impact: partial confidentiality/integrity and partial availability as per NVD metrics; base score 6.4, MEDIU...

CUPS < 1.3.10 Multiple Vulnerabilities

According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10. Such versions are affected by several issues : - A potential integer overflow in the PNG image validation code in 'cupsImageReadPNG' could allow an attacker to crash the affected service or possibly...

Design/Logic Flaw

Blue Coat ProxySG, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet...

CVE-2009-1211

CVE-2009-1211 affects Blue Coat ProxySG when in transparent interception mode. The vulnerability arises because the appliance uses the HTTP Host header to select the remote endpoint, allowing a crafted page to cause a client to send requests with a modified Host header. This can bypass access con...

CVE-2009-1211

Blue Coat ProxySG, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet...

Ziproxy Security Bypass Vulnerability

This host is running Ziproxy server and is prone to security bypass vulnerability. OpenVAS Vulnerability Test $Id: secpodziproxysecbypassvuln.nasl 5676 2017-03-22 16:29:37Z cfi $ Ziproxy Security Bypass Vulnerability Authors: Nikita MR Copyright: Copyright c 2009 SecPod, http://www.secpod.com Thi...

Ziproxy Security Bypass Vulnerability

Ziproxy server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Cross-site scripting XSS vulnerability in the chooseprimaryblog function in wp-includes/wpmu-functions.php in WordPress MU WPMU before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header...