6076 matches found
CVE-2023-36829 Sentry CORS misconfiguration vulnerability
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry...
CVE-2023-22659
An os command injection vulnerability exists in the libzebra.so changehostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...
Milesight UR32L 操作系统命令注入漏洞
The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L libzebra.so changehostname function, which can be exploited by an attacker to execute arbitrary commands on the system...
PT-2023-25718 · Sentry · Sentry
Name of the Vulnerable Software and Affected Versions: Sentry versions 23.6.0 through 23.6.1 Description: Sentry is an error tracking and performance monitoring platform. The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends wi...
Mobileiron Sentry 安全漏洞
Mobileiron Sentry is a Smart Gateway product from Mobileiron, Inc. A security vulnerability exists in Sentry versions 23.6.0 through 23.6.2 and earlier, which stems from the Sentry API returning an incorrect HTTP header if the request header ends in system.base-hostname...
Milesight UR32L libzebra.so change_hostname OS command injection vulnerability
Talos Vulnerability Report TALOS-2023-1699 Milesight UR32L libzebra.so changehostname OS command injection vulnerability July 6, 2023 CVE Number CVE-2023-22659 SUMMARY An os command injection vulnerability exists in the libzebra.so changehostname functionality of Milesight UR32L v32.3.0.5. A...
CVE-2022-42175
Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization...
Authorization
Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization...
SolusVM-WHMCS-Module 安全漏洞
SolusVM-WHMCS-Module is a module. A security vulnerability exists in SolusVM-WHMCS-Module version 4.1.2 that originates from allowing an attacker to make unauthorized changes to passwords and hostnames of other client servers...
CVE-2022-42175
Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization...
CVE-2022-42175
Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization...
D-Link DIR-823G HostName Field Buffer Overflow Vulnerability
The D-Link DIR-823G is a home dual-band Gigabit wireless router with second-generation 802.11ac Wi-Fi5 technology designed for medium- to high-speed broadband networks. The D-Link DIR-823G suffers from a buffer overflow vulnerability that stems from a lack of proper validation of the length of th...
jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...
CVE-2023-26612
D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlInfo...
CVE-2023-26612
D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlInfo...
Buffer overflow
D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlInfo...
GHSA-373W-RJ84-PV6X SafeURL-Python's hostname blocklist does not block FQDNs
Description If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host e.g. adding . to the end. Impact The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library us...
SafeURL-Python's hostname blocklist does not block FQDNs
Description If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host e.g. adding . to the end. Impact The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library us...
PT-2023-32967 · Pypi · Safeurl-Python
Name of the Vulnerable Software and Affected Versions: safeurl-python affected versions not specified Description: The issue allows bypassing of blacklisted hostnames by requesting the FQDN of the host, for example, by adding a . to the end. This could enable an attacker to circumvent blocks set ...
