Brave information leakage vulnerability

Brave is a fast, private and secure web browser from Brave USA. A security vulnerability exists in Brave versions prior to 1.34 that stems from leaks.onion URLs appearing in the headers of Referer and Origin when using a private window with a Tor connection...

CVE-2022-1228

The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-1228

The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13729

Name of the Vulnerable Software and Affected Versions Opensea WordPress plugin versions prior to 1.0.3 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of certain settings, such as the Referer address field. Thi...

CVE-2022-1228: Improper Neutralization of Input During Web Page Generation

The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

RHEL 7 : rh-dotnet31-curl (RHSA-2022:1354)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1354 advisory. .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

curl: Leak of authentication credentials in URL via automatic Referer

It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of the credentials to the server to which requests were redirected...

OrangeHRM Referer header injection redirection vulnerability

Orangehrm is a human resource management system HRM from Orangehrm USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. Orangehrm version 4.10 has a Referer header injection redirection vulnerability, no...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

Design/Logic Flaw

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27109

CVE-2022-27109 affects OrangeHRM 4.10. The issue is a Referer header injection that enables redirect vulnerabilities. The connected Red Hat/CNVD entries reiterate the same description. The documents do not provide details on affected subcomponents, exact exploit steps, scope, or a remediation pat...

CVE-2022-27109: URL Redirection to Untrusted Site

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

PT-2022-18226

Name of the Vulnerable Software and Affected Versions OrangeHRM version 4.10 Description The issue is related to a Referer header injection redirect. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...

Orangehrm has a vulnerability in input validation.

Orangehrm is a human resource management system HRM from Orangehrm USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. Orangehrm version 4.10 has a Referer header injection redirection vulnerability, no...

Online Banquet Booking System 1.0 Cross Site Request Forgery

Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...

ADC 13.0 - Error : Please log on. The server met an error. Please try again or contact your administrator

Error after login to Citrix Gateway: "Please log on The server met an error. Please try again or contact your administrator" Logging in works fine internally through StoreFront server, but fails when trying to log on through Citrix Gateway. The session policy was noted to be looking for a referer...

Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon

The plugin does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed. Version 3.2.0 adressed some of the issues, but was still vulnerable when clicking to edit the...

Jenkins GitLab Authentication Plugin User Redirection Vulnerability

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A user redirection vulnerability exists in Jenkins GitLab Authentication Plugin 1.13 and earlier versions, which stems fr...