CVE-2024-45979

A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...

CVE-2024-45980

A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...

PT-2024-31866 · Meanstore · Meanstore

Name of the Vulnerable Software and Affected Versions: MEANStore version 1.0 Description: A host header injection issue allows attackers to obtain the password reset token via user interaction with a crafted password reset link, enabling them to reset other users' passwords and compromise their...

CVE-2024-45979

A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...

scheduleR 安全漏洞

scheduleR is a framework available to bart6114 individual developers for deploying R tasks, reports and applications. A security vulnerability exists in scheduleR version 0.0.18, which stems from the presence of a host header injection vulnerability that allows an attacker to obtain a password...

MEANStore 安全漏洞

MEANStore is an e-commerce/retail software solution from the individual developer Michael Lynn. A security vulnerability exists in version 1.0 of MEANStore that originates from user interaction with a carefully constructed password reset link, allowing an attacker to obtain a password reset token...

CVE-2024-45982

A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...

Lines Police CAD 安全漏洞

Lines Police CAD is an easy to set up and use police server from the individual developers at Merrill Lines. A security vulnerability exists in Lines Police CAD version 1.0 that originates from user interaction with a carefully constructed password reset link, allowing an attacker to obtain a...

PT-2024-31865 · Unknown · Lines Police Cad

Name of the Vulnerable Software and Affected Versions: Lines Police CAD version 1.0 Description: A host header injection issue allows attackers to obtain the password reset token via user interaction with a crafted password reset link, enabling them to arbitrarily reset other users' passwords and...

PT-2024-31867 · Unknown · Bookreviewlibrary

Name of the Vulnerable Software and Affected Versions: BookReviewLibrary version 1.0 Description: A host header injection issue allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This is achieved through manipulating the host header, which...

PT-2024-31868 · Scheduler · Scheduler

Name of the Vulnerable Software and Affected Versions: scheduleR version 0.0.18 Description: A host header injection vulnerability allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This enables attackers to arbitrarily reset other users'...

CVE-2024-45982

CVE-2024-45982 affects scheduleR v0.0.18 and is described as a host header injection vulnerability. The underlying issue allows an attacker to obtain a password reset token by user interaction with a crafted password reset link, enabling arbitrary password resets and account compromise. The Red H...

CVE-2024-45981

BookReviewLibrary 1.0 is affected by a host header injection vulnerability that lets an attacker obtain a password reset token by interacting with a crafted password reset link. Root cause appears to be host header manipulation affecting the reset flow. The vulnerability is described across multi...

Mozilla: Information disclosure on password cancel endpoint

The password reset cancellation process disclosed the user's IP address in the email sent to the user upon cancellation. This information disclosure vulnerability was exploited to obtain the IP address of a user by tricking them into submitting the password reset cancellation request...

CVE-2024-8290

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFMCustomersManageController::processing function due to missing validation...

CVE-2024-8290

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFMCustomersManageController::processing function due to missing validation...

CVE-2024-8485

The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it...

CVE-2024-8485

The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it...

CVE-2024-8485 REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover

The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it...

CVE-2024-8485

The REST API TO MiniProgram plugin for WordPress is vulnerable to unauthenticated privilege escalation up to version 4.7.1. The flaw is in updateUserInfo(), caused by missing validation of the openid user-controlled key, allowing an attacker to update arbitrary user accounts (e.g., changing email...