CVE-2021-25994 Userfrosting - Host-Header Injection Leads to Account Takeover

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...

Userfrosting 注入漏洞

Userfrosting is a secure, modern Php user management system. a security vulnerability exists in Userfrosting, which stems from the fact that in Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to a host header injection attack. An attacker could exploit the vulnerability to use the forgot...

The vulnerability of the graphical interface of the Fortinet FortiManager device management software and the Fortinet FortiAnalyzer security event monitoring and analysis software allows a malicious individual to inject arbitrary HTTP headers.

The vulnerability of the graphical interface of the FortiManager device management software and the FortiAnalyzer security event monitoring and analysis tool exists due to the failure to implement measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to...

openSUSE 15 Security Update : netdata (openSUSE-SU-2021:1603-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1603-1 advisory. - An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data i...

Zimbra Cross-Site Scripting Vulnerability

Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...

CVE-2020-18984

A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...

CVE-2020-18984

CVE-2020-18984 describes a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration 8.8.12, specifically in the zimbraAdmin/public/secureRequest.jsp component. The issue allows unauthenticated attackers to execute arbitrary web scripts or HTML through host header injection. The ...

CVE-2020-18984

A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...

Zimbra 跨站脚本漏洞

Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...

GHSA-HWQF-GCQM-7353 Header injection in nodemailer

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object...

Header injection in nodemailer

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object...

Log4Shell HTTP Header Injection

Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will exploit an HTTP end point with the Log4Shell vulnerability by...

OrbiTeam BSCW Server XSS / LFI / User Enumeration

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities in BSCW Server product: OrbiTeam BSCW Server vulnerable version: BSCW Server 5.0.x, 5.1.x, =5.2.4, =7.3.x, =7.4.3 fixed version: 5.2.5, 7.4.4 CVE...

MGASA-2021-0519 Updated php packages fix security vulnerability

Header injection via defaultmimetype / defaultcharset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function CVE-2021-21707 XMLReader::getParserProperty may throw with a valid property...

Updated php packages fix security vulnerability

Header injection via defaultmimetype / defaultcharset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function CVE-2021-21707 XMLReader::getParserProperty may throw with a valid property...

CVE-2021-36322

Dell Networking X-Series firmware versions prior to 3.0.1.8 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary host header values to poison the web-cache or trigger redirections...

CVE-2021-36322

CVE-2021-36322 affects Dell Networking X-Series firmware prior to 3.0.1.8. A host header injection vulnerability allows a remote unauthenticated attacker to inject arbitrary host header values to poison web caches or trigger redirects. Affected component: Dell Networking X-Series firmware (prior ...

Dell Networking X-Series 注入漏洞

Dell Networking X-Series is a series of intelligent managed switches from Dell, U.S. A HOST injection vulnerability exists in Dell Networking X-Series, which can be exploited by remote, unauthenticated attackers to poison web caches or trigger redirects by injecting arbitrary host header values...

PT-2021-21224 · Dell · Dell Networking X-Series

Name of the Vulnerable Software and Affected Versions: Dell Networking X-Series firmware versions prior to 3.0.1.8 Description: The issue allows a remote unauthenticated attacker to potentially exploit the vulnerability by injecting arbitrary host header values to poison the web-cache or trigger...