https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:53:18 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-01946 bdu:2023-01946 https://cve.radiocsirt.org/vuln/bdu:2023-01946 https://cve.radiocsirt.org/vuln/euvd-2026-219392 EUVD-2026-219392 https://cve.radiocsirt.org/vuln/euvd-2026-219392 https://cve.radiocsirt.org/vuln/fkie_cve-2023-0100 <p>In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.</p> <p>In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-0100 https://cve.radiocsirt.org/vuln/ghsa-4grc-q4fj-45p8 <p><strong>Affected:</strong> Maven: org.eclipse.birt:org.eclipse.birt.report.viewer</p> <p>In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.</p> <p><strong>Affected:</strong> Maven: org.eclipse.birt:org.eclipse.birt.report.viewer</p> <p>In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.</p> https://cve.radiocsirt.org/vuln/ghsa-4grc-q4fj-45p8 https://cve.radiocsirt.org/vuln/gsd-2023-0100 gsd-2023-0100 https://cve.radiocsirt.org/vuln/gsd-2023-0100