CyberArk Privileged Access Manager Self-Hosted 安全漏洞

CyberArk Privileged Access Manager Self-Hosted is a privileged access self-hosted manager from CyberArk, Israel. A security vulnerability exists in CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4, which stems from an environmental issue where password vault Web access is not...

PT-2025-3075 · Cyberark · Cyberark Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4 Description: The issue arises from inadequate handling of environment problems that can lead to Host header injection. This can potentially allow attackers to manipulate th...

CVE-2024-54840

CVE-2024-54840 describes a vulnerability in CyberArk Privileged Access Manager Self-Hosted PVWA before 14.4, where environment handling can lead to Host header injection. The issue arises from how PVWA resolves environment context, enabling manipulation of the HTTP Host header in affected deploym...

CVE-2024-54840

PVWA Password Vault Web Access in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection...

CVE-2024-54840

PVWA Password Vault Web Access in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

CVE-2024-42671

CVE-2024-42671 affects slabiak Appointment Scheduler v1.0.5. The issue is a Host Header Poisoning Open Redirect, enabling remote redirection to a malicious site. The CVSS base score is 6.1 (Medium) with Network attack vector, no privileges, user interaction required, and a changed scope; impact i...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

CVE-2025-23001

CVE-2025-23001 affects CTFd 3.7.5. The vulnerability is a Host header injection caused by insufficient validation/sanitization of the Host header in HTTP requests. Potential impacts include phishing, password reset manipulation, and cache poisoning as described in multiple sources. Some entries n...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

Appointment scheduler 安全漏洞

Appointment scheduler is a scheduling application written in Java by the individual developer of slabiak. A security vulnerability exists in Appointment scheduler version v.1.0.5, which stems from a host header poisoning open redirection issue that allows remote attackers to redirect users to a...

CTFd 安全漏洞

CTFd is a Capture The Flag framework open-sourced by CTFd. A security vulnerability exists in CTFd version 3.7.5 that stems from a failure to properly validate or clean the Host header, which could lead to a phishing attack, password reset, or cache poisoning...

PT-2025-4762 · Ctfd · Ctfd

Name of the Vulnerable Software and Affected Versions: CTFd version 3.7.5 Description: A Host Header Injection issue exists due to the application's failure to properly validate or sanitize the Host header. This allows an attacker to manipulate the Host header in HTTP requests, potentially leadin...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

ATutor 2.2.4 Host Header Injection

ATutor version 2.2.4 suffers from a host header injection vulnerability. Exploit Title: Host Header Injection - atutorv2.2.4 Date: 01/2025 Exploit Author: Andrey Stoykov Version: 2.2.4 Tested on: Ubuntu 22.04 Blog: https://msecureltd.blogspot.com/2025/01/friday-fun-pentest-series-18-host.html...

CVE-2024-55925

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...