4641 matches found
Security Bulletin: Host header injection vulnerability in Business Automation Studio in Cloud Pak for Automation (CVE-2021-29872)
Summary Business Automation Studio in IBM Cloud Pak for Automation is vulnerable to a host header injection attack. Vulnerability Details CVEID: CVE-2021-29872 DESCRIPTION: IBM ICP4A - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of...
Log4Shell HTTP Header Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Log4Shell HTTP Header Injection', 'Description' = %q Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in...
Omise: Host Header Injection leads to Open Redirect and Content Spoofing or Text Injection.
Summary: 1. Open Redirection The https://dashboard.omise.co/test/dashboard website is vulnerable to an Open Redirection flaw if the server receives a crafted X-Forwarded-Host header. Description: Open Redirect is a vulnerability in which the attacker manipulates a web page to redirect the users t...
GHSA-CV25-3GMG-C6M8 Injection in UserFrosting
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Injection in UserFrosting
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Userfrosting has an unspecified vulnerability
Userfrosting is a secure, modern Php user management system. a security vulnerability exists in Userfrosting, which stems from the fact that in Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to a host header injection attack. An attacker could exploit the vulnerability to use the forgot...
CVE-2021-25994
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
CVE-2021-25994
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Design/Logic Flaw
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
CVE-2021-25994
CVE-2021-25994 concerns Userfrosting versions v0.3.1–v4.6.2 vulnerable to Host Header Injection. The underlying issue allows an unauthenticated attacker to abuse the forgot-password flow by injecting host header data to reset a user’s password, enabling account takeover. Connected documents corro...
CVE-2021-25994 Userfrosting - Host-Header Injection Leads to Account Takeover
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Userfrosting 注入漏洞
Userfrosting is a secure, modern Php user management system. a security vulnerability exists in Userfrosting, which stems from the fact that in Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to a host header injection attack. An attacker could exploit the vulnerability to use the forgot...
The vulnerability of the graphical interface of the Fortinet FortiManager device management software and the Fortinet FortiAnalyzer security event monitoring and analysis software allows a malicious individual to inject arbitrary HTTP headers.
The vulnerability of the graphical interface of the FortiManager device management software and the FortiAnalyzer security event monitoring and analysis tool exists due to the failure to implement measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to...
openSUSE 15 Security Update : netdata (openSUSE-SU-2021:1603-1)
The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1603-1 advisory. - An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data i...
Zimbra Cross-Site Scripting Vulnerability
Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...
CVE-2020-18984
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
CVE-2020-18984
CVE-2020-18984 describes a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration 8.8.12, specifically in the zimbraAdmin/public/secureRequest.jsp component. The issue allows unauthenticated attackers to execute arbitrary web scripts or HTML through host header injection. The ...
CVE-2020-18984
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
Zimbra 跨站脚本漏洞
Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...