openSUSE Security Advisory (SUSE-SU-2024:2974-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42915

A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts...

PT-2024-30204 · Unknown · Staff Appraisal System

Name of the Vulnerable Software and Affected Versions: Staff Appraisal System version 1.0 Description: A host header injection vulnerability in the Staff Appraisal System allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This enables...

CVE-2024-42914

ArrowCMS 1.0.0 is affected by a host header injection in the forgot password feature. A crafted Host header can cause password reset links to be sent to an attacker-controlled server, leaking the reset token and potentially allowing the attacker to reset other users’ passwords. The connected sour...

Staff Appraisal System 安全漏洞

Staff Appraisal System is an employee appraisal system by Debashish Choudhury, an individual developer. A security vulnerability exists in Staff Appraisal System v1.0, which stems from a host header injection vulnerability that can be exploited by an attacker to obtain a password reset token...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42915

Summary: CVE-2024-42915 is a host header injection vulnerability in Staff Appraisal System v1.0. Affected component: the password reset flow within Staff Appraisal System. Root cause/impact: attackers can induce a user to click a crafted password reset link to obtain a password reset token, enabl...

CVE-2024-42915

A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

PT-2024-30203 · Arrowcms · Arrowcms

Name of the Vulnerable Software and Affected Versions: ArrowCMS version 1.0.0 Description: A host header injection vulnerability exists in the forgot password functionality. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to...

ArrowJS CMS 安全漏洞

ArrowJS CMS is a CMS based on ArrowJS framework by Trần Quốc Cường individual developer. A security vulnerability exists in ArrowJS CMS version 1.0.0, which originates from a host header injection issue in the forgot password feature. By sending a specially crafted host header in the forgot...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2024:2982-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2982-1 advisory. Security issues fixed: - CVE-2024-6923: Fixed email header injection due to unquoted newlines bsc1228780 -...

SUSE: Security Advisory (SUSE-SU-2024:2974-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: libpython3_10-1_0 / libpython3_10-1_0-32bit / python310 / etc (SUSE-SU-2024:2974-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2974-1 advisory. Security issue fixed: - CVE-2024-6923: Fixed email header injection due to unquoted newlines bsc1228780 Non-security issues...

SUSE-SU-2024:2974-1 Security update for python310

This update for python310 fixes the following issues: Security issue fixed: - CVE-2024-6923: Fixed email header injection due to unquoted newlines bsc1228780 Non-security issues fixed: - Improve python reproducible builds bsc1227999 - Make pip and modern tools install directly in /usr/local when...

BIT-PYTHON-2024-6923 Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

CentOS 9 : python3.9-3.9.19-7.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-7.el9 build changelog. - There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote newlines for email headers when serializing ...

CVE-2024-6923

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...