CWE-644.

Authentication bypass by spoofing in Eclipse Foundation Eclipse Connected Services Platform

• Eclipse Foundation Eclipse Connected Services Platform
• Authentication bypass
• CWE-644

Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

• monkeytype
• Authentication bypass
• CWE-644

Genkit improper host header validation

• genkit
• CWE-644

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

• SAP_SE SAP Business AI Platform (Approuter)
• CWE-644

picocms Pico - Host Header Injection Enables Script Source Hijacking

• Pico
• CWE-644

SonicWall SonicOS: A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS…

• SonicWall SonicOS
• CWE-644

Tornado vulnerable to Header Injection and XSS via reason argument

• Cross-site scripting (XSS)
• CWE-644

<6.5.3 · fixed in 6.5.3

Missing HTTP Security Headers in DevOps Loop

• HCLSoftware DevOps Loop
• CWE-644

Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

• Gardyn Home Firmware
• Gardyn Studio Firmware
• CWE-644

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

• Path traversal
• CWE-644

<1.17.8 · fixed in 1.17.8

IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed

• IBM Engineering Workflow Management
• CWE-644

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

• Cross-site scripting (XSS)
• Server-side request forgery (SSRF)

>=4.0.0-RC1, <4.18 || >=5.0.0-RC1, <5.10 · fixed in 4.18, 5.10

Improper neutralization of HTTP headers in Password Manager

• Password Manager
• CWE-644

A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.

• IBM DevOps Plan
• CWE-644

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

• CWE-348
• CWE-644

<2.22.0 · fixed in 2.22.0

Fastify's connection header abuse enables stripping of proxy-added headers

• HTTP request smuggling
• CWE-644

<11.4.4 · fixed in 11.4.4

Multiple vulnerabilities have been addressed in IBM Aspera Shares

• IBM Aspera Shares
• CWE-644

Tandoor Recipes Vulnerable to Host Header Injection

• recipes
• CWE-644

IBM InfoSphere Information Server is vulnerable to HTTP header injection

• IBM InfoSphere Information Server
• CWE-644

Multiple vulnerabilities in IBM Aspera Orchestrator

• IBM Aspera Orchestrator
• CWE-644

Multiple vulnerabilities in IBM Aspera Faspex

• IBM Aspera Faspex 5
• CWE-644

@perfood/couch-auth has a host header injection vulnerability

• Other injection
• CWE-644

<=0.26.0 · no fixed version yet

HTTP Host header vulnerability in WebClient and WebScheduler web apps

• arcinfo PcVue
• CWE-644

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where…

• CWE-644

Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

• IBM DB2 Recovery Expert for LUW
• CWE-644

JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax

• ALBRECHT JUNG GMBH & CO. KG JUNG Smart Visu Server
• CWE-644

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• CWE-644

HCL AION is affected by an Host Header Injection vulnerability

• HCL Software AION
• CWE-644

Coolify has host header injection in forgot password

• coollabsio coolify
• CWE-644

MediaCrush Header paths.py http headers for scripting syntax

• MediaCrush
• CWE-644

jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax

• jameschz Hush Framework
• CWE-644

Backdrop CMS Host Header Injection vulnerability

• Open redirect
• CWE-644

<=1.32.0 · no fixed version yet

OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy

• CWE-644

* · no fixed version yet

IBM OpenPages Host Header Injection

• IBM OpenPages
• CWE-644

HCL BigFix WebUI is affected by a host header poisoning vulnerability

• HCL Software BigFix WebUI
• CWE-644

IBM SmartCloud Analytics - Log Analysis HOST header injection

• IBM SmartCloud Analytics Log Analysis
• CWE-644

HTTP host header injection vulnerability in IceWarp Mail Server

• Icewarp Mail Server
• CWE-644

A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-…

• Bosch Rexroth AG ctrlX OS - Device Admin
• CWE-644

IBM i improper HTTP header neutralization

• i
• CWE-644

IBM Aspera Console HTTP header injection

• IBM Aspera Console
• CWE-644

IBM TXSeries for Multiplatforms information disclosure

• IBM TXSeries for Multiplatforms
• CWE-644

Hitachi Energy TRMTracker: A Host Header Injection vulnerability in TRMTracker application may allow an attacker by…

• Hitachi Energy TRMTracker
• CWE-644

IBM Control Center HOST header injection

• IBM Control Center
• CWE-644

Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP

• SAP_SE SAP Fiori for SAP ERP
• CWE-644

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.

• CWE-644

HCL Nomad server on Domino is affected by a host header injection vulnerability

• HCL Software Nomad server on Domino
• CWE-644

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability

• CWE-116
• CWE-644

>=1.9.0, <1.20.1 · fixed in 1.20.1

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.

• Sharp Corporation Sharp Digital Full-color MFPs and Monochrome MFPs
• Toshiba Tec Corporation e-STUDIO 908
• CWE-644

IBM Aspera Orchestrator HTTP header injection

• IBM Aspera Orchestrator
• CWE-644

IBM Datacap Navigator HTTP HOST header injection

• IBM Datacap Navigator
• CWE-644

Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

• CWE-644

* · no fixed version yet

IBM Aspera Faspex HTTP header injection

• IBM Aspera Faspex
• CWE-644

IBM Engineering Lifecycle Optimization HTTP header injection

• IBM Engineering Lifecycle Optimization - Publishing
• CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4

• Arcadia Technology, LLC Crafty Controller
• CWE-644

IBM Tivoli Application Dependency Discovery Manager HOST header injection

• IBM Tivoli Application Dependency Discovery Manager
• CWE-644

Spring HATEOAS vulnerable to Improper Neutralization of HTTP Headers for Scripting Syntax

• CWE-116
• CWE-644

<1.5.5 || >=2.0.0, <2.0.5 || >=2.1.0, <2.1.1 · fixed in 1.5.5, 2.0.5, 2.1.1

Header Injection in SAP Solution Manager (Diagnostic Agent)

• SAP_SE SAP Solution Manager (Diagnostic Agent)
• CWE-644

Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability.

• Dell PowerProtect Cyber Recovery
• CWE-644

Dell Data Protection Central: Dell EMC Data Protection Central, versions 19.1 through 19.7…

• Dell Data Protection Central
• CWE-644

IBM API Connect HOST header injection

• IBM API Connect
• CWE-644