171 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-16434
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard...
Linux Distros Unpatched Vulnerability : CVE-2026-34959
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVERREQUESTURI with no trusted-proxy check and no validation of the pref...
CVE-2026-34959
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...
DEBIAN-CVE-2026-34959
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...
DEBIAN-CVE-2026-16434
Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...
CVE-2026-16434
Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...
CVE-2026-16434 Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass
Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...
CVE-2026-34959 Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...
EUVD-2026-65195
Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...
CVE-2026-34959
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] without a trusted-proxy check or validation of the prefix value. An attacker can inject an absolute URL (e.g., https://evil.example) that propagates into Location redirect headers, the Set...
EUVD-2026-65196
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...
CVE-2026-34959 Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...
CVE-2026-16434
Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...
CVE-2026-16434
Adminer versions 4.6.0 through 5.5.0 contain an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php uses the regex ^/[^/] to reject malicious prefixes, which blocks //evil.com but allows values like /\evil.com where the s...
CVE-2026-16434 Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass
Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...
SUSE CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...
CVE-2026-56581
HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...
CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set
HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...
CVE-2026-56581
CVE-2026-56581 affects HCL MyCloud with a Cookie Attribute Path Not Set issue. The vulnerability is described as enabling potential unauthorized access to session data or authentication tokens due to cookies not setting the Path attribute, increasing exposure. The available sources (NVD/CVELIST) ...