122 matches found
CVE-2025-28097
OneNav 1.1.0 is vulnerable to Cross Site Scripting XSS in custom headers...
CVE-2025-28096
OneNav version 1.1.0 , a bookmark management tool, is vulnerable to Server-Side Request Forgery (SSRF) due to an issue in custom headers . This flaw could allow an attacker to force the server to make requests to arbitrary domains, potentially resulting in unauthorized access to sensitive data or...
CVE-2025-28097
OneNav 1.1.0 is vulnerable to Cross Site Scripting XSS in custom headers...
PT-2025-13592
Name of the Vulnerable Software and Affected Versions OneNav version 1.1.0 Description The issue is related to Cross Site Scripting XSS in custom headers. This means that an attacker could potentially inject malicious scripts into the headers of the OneNav application, which could then be execute...
CVE-2025-28097: Improper Neutralization of Input During Web Page Generation
OneNav 1.1.0 is vulnerable to Cross Site Scripting XSS in custom headers...
CVE-2025-28096: Server-Side Request Forgery (SSRF)
OneNav 1.1.0 is vulnerable to Server-Side Request Forgery SSRF in custom headers...
CVE-2025-28097
OneNav 1.1.0 is vulnerable to Cross Site Scripting XSS in custom headers...
CVE-2025-28096
OneNav 1.1.0 is vulnerable to Server-Side Request Forgery SSRF in custom headers...
CVE-2025-0588
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly...
CVE-2025-0588
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly...
CVE-2025-0588
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly...
CVE-2025-0588
CVE-2025-0588 affects Octopus Server. A user with sufficient access could send crafted referrer headers to enable setting custom headers in all server responses, causing subsequent responses to return 500 errors and rendering the site largely unusable. This creates a denial-of-service state that ...
CVE-2025-0588
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly...
PT-2025-6210 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: In affected versions of Octopus Server, a user with sufficient access could set custom headers in all server responses. By submitting a specifically crafted referrer header, the user...
Mass-Assigner - Simple Tool Made To Probe For Mass Assignment Vulnerability Through JSON Field Modification In HTTP Requests
Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter extracted from th...
SUSE-EL-9-CLIENT-TOOLS-2023-3875 Security update for SUSE Manager Client Tools
This update fixes the following issues: golang-github-lusitaniae-apacheexporter: - Security issues fixed: CVE-2022-32149: Fix denial of service vulnerability bsc1204501 CVE-2022-41723: Fix uncontrolled resource consumption bsc1208270 CVE-2022-46146: Fix authentication bypass vulnarability...
Paradox Security Systems IPR512 Denial Of Service
!/bin/bash Exploit Title: Paradox Security Systems IPR512 - Denial Of Service Google Dork: intitle:"ipr512 - login screen" Date: 09-APR-2023 Exploit Author: Giorgi Dograshvili Vendor Homepage: Paradox - Headquarters https://www.paradox.com/Products/default.asp?PID=423 Version: IPR512 CVE :...
CVE-2022-3767
Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host...