CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
A kind of CWE-116 Improper Encoding or Escaping of Output.
From the CWE List. © The MITRE Corporation.
Newest
- eclipse foundation connected services platform In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver... 7.5 High
- monkeytypegame monkeytype Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass) 7.5 High
- genkit-ai genkit Genkit improper host header validation 7.8 High
- sap approuter, sap se business ai platform (approuter) +1 more Multiple vulnerabilities in SAP Business AI Platform (Approuter) 5.3 Medium
- picocms pico picocms Pico - Host Header Injection Enables Script Source Hijacking 6.1 Medium
- sonicwall sonicos A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could... 6.5 Medium
- hcl software devops loop Missing HTTP Security Headers in DevOps Loop 3.7 Low
- gardyn cloud api, home firmware, studio firmware +2 more Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax 5.1 Medium
- ibm engineering workflow management IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed 6.5 Medium
- craftcms cms Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs 6.9 Medium
- one identity password manager, password manager manager +1 more Improper neutralization of HTTP headers in Password Manager 5.1 Medium
- hcltech devops plan A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests. 6.5 Medium
- litestar-org litestar Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header 5.9 Medium
- xyproto algernon Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir 8.2 High
- @fastify/reply-from @fastify/http-proxy, @fastify/reply-from, fastify reply-from +3 more +5 more @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers 9.0 Critical
- ibm aspera shares Multiple vulnerabilities have been addressed in IBM Aspera Shares 5.4 Medium
- tandoor recipes Tandoor Recipes Vulnerable to Host Header Injection 8.1 High
- ibm infosphere information server IBM InfoSphere Information Server is vulnerable to HTTP header injection 6.5 Medium
- ibm aspera orchestrator Multiple vulnerabilities in IBM Aspera Orchestrator 5.4 Medium
- ibm aspera faspex 5, aspera faspex +1 more Multiple vulnerabilities in IBM Aspera Faspex 5.4 Medium
-
@perfood/couch-authnpm @perfood/couch-auth has a host header injection vulnerability 9.3 Critical - arcinfo pcvue HTTP Host header vulnerability in WebClient and WebScheduler web apps 5.3 Medium
- monicahq monica A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP... 9.1 Critical
- ibm db2 recovery expert for luw, db2 recovery expert +1 more Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows 6.5 Medium
- albrecht jung gmbh & co. kg jung smart visu server, jung-group smart visu server firmware +1 more JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax 8.7 High
- ibm concert Multiple Vulnerabilities in IBM Concert Software 6.5 Medium
- hcl aion HCL AION is affected by an Host Header Injection vulnerability 2.7 Low
- coollabs coolify Coolify has host header injection in forgot password 8.5 High
- tornadoweb tornado Tornado vulnerable to Header Injection and XSS via reason argument 5.4 Medium
- No product listed MediaCrush Header paths.py http headers for scripting syntax 6.9 Medium
- jameschz hush, hush framework +1 more jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax 6.9 Medium
- backdropcms backdrop cms Backdrop CMS Host Header Injection vulnerability 6.1 Medium
- ibm openpages IBM OpenPages Host Header Injection 5.4 Medium
- oauth2-proxy OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation 8.5 High
- hcl software bigfix webui HCL BigFix WebUI is affected by a host header poisoning vulnerability 6.1 Medium
- ibm smartcloud analytics log analysis IBM SmartCloud Analytics - Log Analysis HOST header injection 5.4 Medium
- icewarp mail server HTTP host header injection vulnerability in IceWarp Mail Server 2.0 Low
- bosch rexroth ag ctrlx os - device admin A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to... 5.0 Medium
- ibm i IBM i improper HTTP header neutralization 5.4 Medium
- ibm aspera console IBM Aspera Console HTTP header injection 5.4 Medium
- ibm txseries for multiplatforms IBM TXSeries for Multiplatforms information disclosure 5.3 Medium
- hitachi energy trmtracker A Host Header Injection vulnerability in TRMTracker application may allow an attacker by... 6.1 Medium
- ibm control center, sterling control center +1 more IBM Control Center HOST header injection 5.4 Medium
- sap se fiori for sap erp Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP 3.1 Low
- No product listed A Host Header Injection vulnerability exists in CTFd 3.7.5, due to the application failing to... 6.1 Medium
- ibm i IBM i authentication bypass 4.3 Medium
- hcl software nomad server on domino, hcltech hcl nomad +1 more HCL Nomad server on Domino is affected by a host header injection vulnerability 5.3 Medium
- hashicorp consul, consul enterprise +1 more Consul L7 Intentions Vulnerable To Headers Bypass 8.3 High
- sharp bp-30c25 firmware, bp-30c25t firmware, bp-30c25y firmware +321 more +323 more Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow... 7.4 High
- ibm aspera orchestrator IBM Aspera Orchestrator HTTP header injection 5.4 Medium
- Show olderLoading…