4964 matches found
PT-2020-12863
Name of the Vulnerable Software and Affected Versions qdPM version 9.1 Description A Host Header Injection issue may allow an attacker to spoof a particular header and redirect users to malicious websites. Recommendations For qdPM version 9.1, update to a version that includes a fix for this issu...
Cisco Webex Business Suite Data Forgery Issue Vulnerability
Cisco Webex Business Suite is a set of video conferencing solutions from the U.S. company Cisco Cisco. A data forgery vulnerability exists in Cisco Webex Business Suite versions prior to 39.1.0, which stems from the program failing to properly validate the 'host' field in the message header. An...
CVE-2019-1866
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a...
CVE-2019-1866 Cisco Webex Business Suite Host Header Value Integrity Vulnerability
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a...
CVE-2019-1866: Improper Access Control
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a...
CVE-2020-11702
An issue was discovered in ProVide formerly zFTPServer through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter...
Cross site scripting
An issue was discovered in ProVide formerly zFTPServer through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter...
CVE-2020-11702: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ProVide formerly zFTPServer through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter...
Vesta Control Panel and Hestia Control Panel Password Reset Module Information Disclosure Vulnerability
Vesta Control Panel VestaCP is an open source web hosting control panel.Hestia Control Panel is an open source hosting control panel. A security vulnerability exists in the Password Reset Module in VestaCP versions 0.9.8-25 and earlier and Hestia Control Panel versions 1.1.0 and earlier. An...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
Design/Logic Flaw
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
Summary (CVE-2020-10966): The vulnerability affects Vesta Control Panel and Hestia Control Panel Password Reset Module. Through versions VestaCP up to 0.9.8-25 (and Hestia up to 1.1.1), an attacker can manipulate the Host header to cause an account takeover, as the reset URL delivered to the vict...
CVE-2020-10966: Undefined Security Weakness
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
PT-2020-12454
Name of the Vulnerable Software and Affected Versions VESTA Control Panel versions 0.9.8-25 and earlier Hestia Control Panel versions prior to 1.1.1 Description The issue allows for account takeover through Host header manipulation in the Password Reset Module. This occurs because the victim...
Caldera Access Control Error Vulnerability
Caldera is a suite of software from the French company Caldera that provides color management, imaging and processing solutions for printer devices. An access control error vulnerability exists in authsvc in versions of Caldera prior to 2.6.5, which can be exploited by an attacker to bypass...