Vulnerabilities (CVE)

Filtered by CWE-644
Total 23 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-34316 1 Ibm 1 Cics Tx 2024-11-21 N/A 3.7 LOW
IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers. IBM X-Force ID: 229452.
CVE-2021-41114 1 Typo3 1 Typo3 2024-11-21 5.0 MEDIUM 4.8 MEDIUM
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.
CVE-2024-47549 2 Sharp, Toshibatec 640 Bp-30c25, Bp-30c25 Firmware, Bp-30c25t and 637 more 2024-11-05 N/A 6.1 MEDIUM
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.