CVE-2024-42915

The Staff Appraisal System v1.0 is susceptible to a host header injection vulnerability. This flaw allows an attacker to intercept a password reset token by tricking a user into interacting with a crafted password reset link. Successful exploitation enables the attacker to arbitrarily reset other...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

Staff Appraisal System Security Vulnerabilities

Staff Appraisal System is an employee appraisal system by Debashish Choudhury, an individual developer. A security vulnerability exists in Staff Appraisal System v1.0, which stems from a host header injection vulnerability that can be exploited by an attacker to obtain a password reset token...

ArrowJS CMS security vulnerability

ArrowJS CMS is a CMS based on ArrowJS framework by Trần Quốc Cường individual developer. A security vulnerability exists in ArrowJS CMS version 1.0.0, which originates from a host header injection issue in the forgot password feature. By sending a specially crafted host header in the forgot...

CVE-2024-42915

A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts...

PT-2024-30203 · Arrowcms · Arrowcms

Name of the Vulnerable Software and Affected Versions: ArrowCMS version 1.0.0 Description: A host header injection vulnerability exists in the forgot password functionality. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42915: Weak Password Recovery Mechanism for Forgotten Password

A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts...

CVE-2024-42914: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

SUSE: Security Advisory (SUSE-SU-2024:2974-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2024:2982-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2982-1 advisory. Security issues fixed: - CVE-2024-6923: Fixed email header injection due to unquoted newlines bsc1228780 -...

SUSE SLES15: libpython3_10-1_0 / libpython3_10-1_0-32bit / python310 / etc (SUSE-SU-2024:2974-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2974-1 advisory. Security issue fixed: - CVE-2024-6923: Fixed email header injection due to unquoted newlines bsc1228780 Non-security issues...

SUSE-SU-2024:2974-1 Security update for python310

This update for python310 fixes the following issues: Security issue fixed: - CVE-2024-6923: Fixed email header injection due to unquoted newlines bsc1228780 Non-security issues fixed: - Improve python reproducible builds bsc1227999 - Make pip and modern tools install directly in /usr/local when...

BIT-PYTHON-2024-6923 Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

CentOS 9 : python3.9-3.9.19-7.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-7.el9 build changelog. - There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote newlines for email headers when serializing ...

CVE-2024-6923

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

SUSE CVE-2024-6923

There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

Python Email Header Injection Vulnerability (Aug 2024) - Windows

Python is prone to an email header injection vulnerability in the email module. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Python Email Header Injection Vulnerability (Aug 2024) - Linux

Python is prone to an email header injection vulnerability in the email module. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...