CWE-644 vulnerabilities

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

CVE-2024-51451 is a medium severity vulnerability in IBM Concert versions 1.0.0 through 2.1.0 caused by improper validation of HOST headers, leading to HTTP header injection. This flaw allows attackers to perform cross-site scripting (XSS), cache poisoning, or session hijacking without requiring authentication or user interaction. The vulnerability impacts confidentiality and integrity but not availability. Exploitation is remotely feasible with low complexity. European organizations using IBM Concert, especially in countries with significant IBM enterprise deployments, are at risk. Mitigations include strict validation and sanitization of HOST headers, deploying web application firewalls with custom rules, and monitoring HTTP traffic for anomalies.

HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.

CVE-2025-64425 is a high-severity vulnerability in Coolify versions up to 4.0.0-beta.434, an open-source server and application management tool. The flaw involves improper neutralization of HTTP headers, specifically allowing an attacker to manipulate the Host header during a password reset request. This manipulation causes the victim to receive a password reset email containing a link pointing to a malicious host controlled by the attacker. If the victim clicks the link, their reset token is leaked to the attacker, enabling account takeover. No authentication or privileges are required to exploit this vulnerability, but user interaction (clicking the malicious link) is necessary. There is no known patch at the time of publication, and no known exploits in the wild have been reported. The CVSS v4.

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks.

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.

IBM TXSeries for Multiplatforms 9.1 and 11.1 could disclose sensitive information to a remote attacker due to improper neutralization of HTTP headers.

A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e.the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.