Improper Neutralization of HTTP Headers for Scripting Syntax
CWE-644
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
We track 20 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
How this weakness is prevented
- Architecture and Design: Carefully control data that is being placed both in HTTP response headers and in the HTTP response body to ensure that no scripting syntax is present, taking various encodings into account. Perform output validation in order to filter/escape/encode unsafe data that is being passed from the server in an HTTP response header.
- Architecture and Design: Disable script execution functionality in the clients' browser.
Latest Improper Neutralization of HTTP Headers for Scripting Syntax vulnerabilities
- 8.3 High severity
N-central: Improper Neutralization of HTTP Headers for Scripting Syntax
Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1.
- 7.5 High severity
Eclipse Connected Services Platform: Authentication Bypass by Spoofing
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and
- 7.5 High severity
monkeytype: Authentication Bypass by Spoofing
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived
- 7.8 High severity
genkit: Improper Neutralization of HTTP Headers for Scripting Syntax
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit acti
- 8.2 High severity
algernon: Improper Limitation of a Pathname to a Restricted Directory
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configu
- 8.6 High severity
@fastify/reply-from: Improper Neutralization of HTTP Headers for Scripting Syntax
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers fro
- 8.1 High severity
recipes: Improper Neutralization of HTTP Headers for Scripting Syntax
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The
- 9.1 Critical severity
Monica: Improper Neutralization of HTTP Headers for Scripting Syntax
A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The a
- 8.8 High severity
JUNG Smart Visu Server: Improper Neutralization of HTTP Headers for Scripting Syntax
JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to gener
- 9.8 Critical severity
AION: Improper Neutralization of HTTP Headers for Scripting Syntax
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
- 8.1 High severity
coolify: Improper Neutralization of HTTP Headers for Scripting Syntax
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a
- 7.3 High severity
MediaCrush: Improper Neutralization of HTTP Headers for Scripting Syntax
A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of the component Header Handler. Such manipulation of the argument Host leads to improper neutralization of http headers for
- 7.5 High severity
Hush Framework: Improper Neutralization of HTTP Headers for Scripting Syntax
A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Util.php of the component HTTP Host Header Handler. This manipulation of the argument $_SERVER['HOST'] causes improper neu
- 8.5 High severity
oauth2-proxy: Improper Neutralization of HTTP Headers for Scripting Syntax
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of application
- 7.5 High severity
TXSeries for Multiplatforms: Improper Neutralization of HTTP Headers for Scripting Syntax
IBM TXSeries for Multiplatforms 9.1 and 11.1 could disclose sensitive information to a remote attacker due to improper neutralization of HTTP headers.
- 9.8 Critical severity
Datacap Navigator: Improper Encoding or Escaping of Output
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cro
- 7.5 High severity
Crafty Controller: Improper Encoding or Escaping of Output
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
- 9.8 Critical severity
Tivoli Application Dependency Discovery Manager: Improper Encoding or Escaping of Output
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable syst
- 7.2 High severity
SAP Solution Manager (Diagnostic Agent): Improper Encoding or Escaping of Output
SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited im
- 8.8 High severity
PowerProtect Cyber Recovery: Improper Neutralization of HTTP Headers for Scripting Syntax
Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unauthorized admin access to the Cyber Recovery application. Exploitation may lead to complete system takeo