CVE-2022-25881

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library...

CVE-2023-24044

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...

CVE-2006-20001

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier...

Race Conditional exists in the collection

Description Ordinary users can use this vulnerability to attack other users' question collection, which can break through a single user's operation of only collecting or canceling the collection, resulting in too many or negative collections Proof of Concept step1 . Open burp, click collection, a...

Cross site request forgery (csrf)

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address...

CVE-2022-45027

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address...

CVE-2022-45027

The CVE-2022-45027 issue affects perfSONAR prior to version 4.4.6. During participant discovery, the software incorrectly uses an HTTP request header value to determine the local address, which can affect how the local endpoint is identified during discovery. The available documents describe this...

Input validation

Due to insufficient input validation, SAP NetWeaver AS Java HTTP Provider Service - version 7.50, allows an unauthenticated attacker to inject a script into a web request header. On successful exploitation, an attacker can view or modify information causing a limited impact on the confidentiality...

CVE-2022-41262

CVE-2022-41262 affects SAP NetWeaver AS Java (HTTP Provider Service), version 7.50. The issue is due to insufficient input validation that allows an unauthenticated attacker to inject a script into a web request header. The resulting impact is described as limited in confidentiality and integrity...

CVE-2022-41262

Due to insufficient input validation, SAP NetWeaver AS Java HTTP Provider Service - version 7.50, allows an unauthenticated attacker to inject a script into a web request header. On successful exploitation, an attacker can view or modify information causing a limited impact on the confidentiality...

SAP NetWeaver AS 跨站脚本漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides web services, but is also the basic platform for SAP software. A cross-site scripting vulnerability exists in SAP NetWeaver AS Java HTTP Provider Service version 7.50, which originates from a vulnerability that...

PT-2022-24469 · Zalando · Zalando Skipper

Name of the Vulnerable Software and Affected Versions: Zalando Skipper versions prior to v0.13.237 Description: The issue allows an attacker to exploit a vulnerable version of the proxy to access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Prox...

CVE-2022-39267

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With:...

Bifrost vulnerable to authentication check flaw that leads to authentication bypass

Impact The admin and monitor user groups need to be authenticated by username and password. If we delete the X-Requested-With: XMLHttpRequest field in the request header,the authentication will be bypassed. Patches https://github.com/brockercap/Bifrost/pull/201 Workarounds Upgrade to the latest...

CVE-2022-2466

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior...

Quarkus 环境问题漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus version 2.10.x that stems from an HTTP request header environment that will not terminate...

CVE-2020-23622

An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header...

undici 注入漏洞

undici is an HTTP/1.1 client. A security vulnerability exists in undici version 5.8.0 and earlier, which stems from a user's susceptibility to CRLF Injection in the header when using unfiltered input as the request header...

CVE-2022-32148

A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality...

Mattermost Default Configuration Error Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a default configuration error that could be exploited by an attacker to bypass some existing rate limits or to use a manipulated IP for audit logging by manipulating the request header...