DEBIAN-CVE-2023-29406

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

AZL-37420 CVE-2023-29406 affecting package golang for versions less than 1.21.6-1

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

AZL-10149 CVE-2022-32212 affecting package nodejs for versions less than 16.20.2-4

A OS Command Injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks...

CentOS 8 : grafana (CESA-2021:4226)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4226 advisory. - grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call CVE-2021-27358 - golang: crypto/elliptic:...

RHEL 8 : grafana (RHSA-2021:4226)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4226 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have be...

HackerOne: Invalid Host detection at https://hackerone.com/redirect

Hello,99 Summary: Host detection at https://hackerone.com/redirect is invalid and insecure. Description : On redirection page, host is detected and highlighted to prevent phishing attacks. But that protection is weak and can be bypassed. So an attacker can redirect victim on another host instead ...

Open Redirect

rails is vulnerable to open redirects. The X-Forwarded-Host HTTP header is always trusted, allowing a malicious user to pass an invalid host header to redirect a user to a malicious URL...

squid DoS

Crash on invalid Host: header...

Authentication flaw

Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host header, possibly involving a trailing dot in the hostname...

CVE-2008-6916

Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host header, possibly involving a trailing dot in the hostname...

CVE-2008-6916

CVE-2008-6916 affects Siemens SpeedStream 5200 with NetPort Software 1.1. The issue is an authentication bypass that can be triggered by an invalid Host header, possibly involving a trailing dot in the hostname. The NVD entry reports a high risk with CVSS v2 base score 10.0 (Network, low access c...

CVE-2005-1112

IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages .jsp via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the...