CVE-2022-0935

CVE-2022-0935 affects livehelperchat/livehelperchat prior to 3.97 and is caused by Host Header injection in the password reset flow. Multiple sources (NVD, Red Hat, OSV, CNVD, PT-Security, CNVD) describe an attacker abusing header handling to forge or manipulate password reset tokens, potentially...

CVE-2022-0935 Host Header injection in password Reset in livehelperchat/livehelperchat

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97...

OrangeHRM Referer header injection redirection vulnerability

Orangehrm is a human resource management system HRM from Orangehrm USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. Orangehrm version 4.10 has a Referer header injection redirection vulnerability, no...

OrangeHRM input validation error vulnerability

Orangehrm is a human resource management system HRM from Orangehrm, Inc. The system supports personnel information management, leave management, attendance management and recruitment management, etc. Orangehrm version 4.10 has an input validation error vulnerability, which stems from vulnerabilit...

PT-2022-13536 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: livehelperchat/livehelperchat versions prior to 3.97 Description: The issue concerns a Host Header injection in the password reset functionality. This problem is associated with the GitHub repository livehelperchat/livehelperchat...

CVE-2022-27110

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27110

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

Design/Logic Flaw

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

CVE-2022-27110

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

CVE-2022-27110

OrangeHRM 4.10 is reported vulnerable to a Host header injection redirect via the viewPersonalDetails endpoint. The issue stems from input handling that allows HTTP Host header manipulation to redirect users to an unintended URL, potentially exposing or guiding users to a personal-details interfa...

CVE-2022-27110

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

Orangehrm 输入验证错误漏洞

Orangehrm is a human resource management system HRM from Orangehrm USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. Orangehrm version 4.10 has a Referer header injection redirection vulnerability, no...

Orangehrm 输入验证错误漏洞

Orangehrm is a human resource management system HRM from Orangehrm, Inc. The system supports personnel information management, leave management, attendance management and recruitment management, etc. Orangehrm version 4.10 has an input validation error vulnerability, which stems from vulnerabilit...

gateway: radosgw: CRLF injection

A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when makin...

CVE-2022-24181

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...

CVE-2022-24181

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...

CVE-2022-24181

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...

CVE-2022-24181

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...

PT-2022-28159 · Guzzle +3 · Guzzlehttp/Psr7 +3

Name of the Vulnerable Software and Affected Versions: guzzlehttp/psr7 versions prior to 1.9.1 guzzlehttp/psr7 versions prior to 2.4.5 Description: The issue concerns improper header parsing, allowing an attacker to sneak in a newline into both the header names and values. Many servers will also...