14 matches found
EUVD-2026-95211
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...
CVE-2026-107393 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...
CVE-2026-107393
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...
CVE-2026-107393
Prior to version 1.8.235 , FreeScout (a self-hosted help desk) is vulnerable to Stored HTML Injection when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. Th...
CVE-2026-107393: Improper Neutralization of Input During Web Page Generation
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...
PT-2026-108190
Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.235 Description When the APP CLOUDFLARE IS USED setting is enabled, the software trusts an unvalidated CF-Connecting-IP header during failed login attempts and records the spoofed value in the activity log. The...
CVE-2022-23238
Linux deployments of StorageGRID formerly StorageGRID Webscale versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email...
Design/Logic Flaw
Linux deployments of StorageGRID formerly StorageGRID Webscale versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email...
CVE-2022-23238: Undefined Security Weakness
Linux deployments of StorageGRID formerly StorageGRID Webscale versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email...
Threat Outbreak Alert RuleID19644: Email Messages Distributing Malicious Software on November 24, 2015
Medium Alert ID: 42263 First Published: 2015 November 25 13:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19644 may contain the following files: Name |...
WordPress Plugin IndiaNIC FAQs Manager 1.0 - Multiple Vulnerabilities
WordPress Plugin IndiaNIC FAQs Manager 1.0 - Multiple Vulnerabilities alert1 in question parameter. The Captcha value can be read from captcha parameter hidden field Part of Ask Question form =================== We don't need the captcha Image when we have this xD Request from Ask Question area X...
Unfixed XSS vulnerability at www.reklams.com
Security researcher CWOmer, has submitted on 19/07/2008 a cross-site-scripting XSS vulnerability affecting www.reklams.com, which at the time of submission ranked 2310426 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/11/2008. It is current...
Unfixed XSS vulnerability at www.sportdog.gr
Security researcher St@R-gaZ3r, has submitted on 01/11/2007 a cross-site-scripting XSS vulnerability affecting www.sportdog.gr, which at the time of submission ranked 18014 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is...
