Improper Neutralization of HTTP Headers for Scripting Syntax

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

CVEs (65)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-41114 1Typo3 1Typo3 Jun 17, 2026 Oct 5, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3...Show more TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.Show less
CVE-2021-20784 1Voidtools 1Everything Jun 17, 2026 Jul 14, 2021 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product.
CVE-2021-21265 1Octobercms 1October Jun 17, 2026 Mar 10, 2021 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of t...Show more October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.Show less
CVE-2020-6982 1Honeywell 1Win Pak Jun 17, 2026 Mar 24, 2020 N/A· v4 8.8 HIGH· v3 5.8 MEDIUM· v2 In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
CVE-2017-6031 1Certec Edv Gmbh 1Atvise Scada May 13, 2026 May 6, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execu...Show more A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.Show less

Previous 1 2 34