60 matches found
SolarWinds Web Help Desk Ticket Read (CVE-2024-28987)
Horizon3 PoC: default helpdeskIntegrationUser Basic auth on /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets — data read only. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2024-28987 — SolarWinds Web Help Desk hardcoded API credentials Horizon3. Auxiliary: reads Orion tickets via Basic auth...
CVE-2026-74864
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
CVE-2026-74864 Authentication Bypass in sogo_yhn
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
CVE-2026-74864 Authentication Bypass in sogo_yhn
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
CVE-2026-74864
The sogo_yhn component contains an authentication bypass vulnerability because it configures SOGo to trust the x-webobjects-remote-user HTTP header as a verified identity without performing password validation. Since Nginx does not strip this header, an unauthenticated remote attacker can supply ...
EUVD-2026-89796
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
PT-2026-103127
sogo yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
CVE-2026-74864: Authorization Bypass Through User-Controlled Key
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
CVE-2022-37724
Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces...
EUVD-2008-2314
Malware in sbrugna...
EUVD-2000-0298
Malware in sbrugna...
EUVD-2006-1470
Malware in sbrugna...
EUVD-2011-3951
Malware in sbrugna...
EUVD-2006-4375
Malware in sbrugna...
CVE-2011-3998
Cross-site scripting XSS vulnerability in Apple WebObjects 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
GHSA-XV7R-9VQ4-9WRQ Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting
Project Wonder WebObjects 1.0 through 7.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available at commit number b0d2d74f13203268ea254b02552600850f28014b...
Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting
Project Wonder WebObjects 1.0 through 7.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available at commit number b0d2d74f13203268ea254b02552600850f28014b...
CVE-2022-37724
Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces...
Design/Logic Flaw
Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces...