CVE-2021-20101

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Jun 29, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-201028.8Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.CVE-2021-201036.1Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded withCVE-2021-201048.1Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uplCVE-2021-201056.1Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.CVE-2021-201066.5Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator CVE-2021-201075.4There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers includCVE-2021-201087.5Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certifiCVE-2021-201097.5Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to mCVE-2021-20115.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.32 and prior and CVE-2021-201109.8Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure theiCVE-2021-201115.4A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename begginiCVE-2021-201125.4A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.php with a filename be