CVE-2017-14087
HighSummary
CVE-2017-14087 is a Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) that may allow an attacker to spoof a particular Host header. This enables the attacker to render arbitrary links pointing to a malicious website with poisoned Host header webpages.
Risk Assessment
The organization may be exposed to phishing attacks and other forms of fraud that leverage malicious websites. Users could be misled and at risk of data loss or system infection.
Recommendation
It is recommended to update Trend Micro OfficeScan to the latest version to mitigate this vulnerability. Additionally, implementing monitoring and filtering mechanisms for network traffic to detect suspicious headers is advisable.
Related vulnerabilities
- CVE-2026-8066Critical
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device's intended operation.
- CVE-2026-8065Critical
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
- CVE-2026-15390Critical
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- CVE-2026-96431Critical
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
- CVE-2026-96429Critical
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2026-96428Critical
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
- CVE-2026-84154Critical
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
- CVE-2026-102240Critical
A vulnerability was found in Netcore NAP930 0.1.241010.141410 in the eval function of the /www/cgi-bin/network_tools file of the Network Tools CGI component. Manipulation of the sid argument results in OS command injection. The attack can be performed remotely and the exploit has been made public.
- CVE-2026-101354Critical
A security flaw was discovered in FAST FAC1203R 20200116_2.0.4 in the _tWlanTask function of the MmtAtePrase Parser component. Manipulation results in a stack-based buffer overflow. The attacker must have access to the local network, and the exploit has been released.
- CVE-2026-102361Critical
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
Original NVD description (English source)
A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS