APIIDA API Gateway Manager Security Vulnerability

APIIDA API Gateway Manager for Broadcom Layer7 is an APIIDA API gateway manager for Broadcom Layer7 from APIIDA Germany. It enables fast and reliable API deployment and migration as well as comprehensive API monitoring and alerting. A security vulnerability exists in APIIDA API Gateway Manager...

PT-2024-12818 · Npm · @Perfood/Couch-Auth

Name of the Vulnerable Software and Affected Versions: @perfood/couch-auth versions = 0.20.0 Description: A host header injection issue exists in the NPM package @perfood/couch-auth. By sending a specially crafted host header in the forgot password request, it is possible to send password reset...

CVE-2023-50093

CVE-2023-50093 affects APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 and is a Host Header Injection vulnerability. The Red Hat, NVD, and CVE listings corroborate a host header issue in APIIDA API Gateway Manager for Broadcom Layer7 2023.2.2. The issue stems from an injection vulnerabil...

OESA-2023-1911 python-twisted security update

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host...

OESA-2023-1910 python-twisted security update

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host...

CVE-2023-49805 Uptime Kuma Missing Origin Validation in WebSockets

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...

CVE-2023-48205

Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails...

CVE-2023-48205

CVE-2023-48205 – Jorani Leave Management System 1.0.2 is affected by a Host Header Injection vulnerability that can allow a remote attacker to spoof the Host header associated with password reset emails. Public sources (e.g., exploit discussions and vulnerability notes) describe the issue as a ho...

CVE-2023-48205

Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails...

Host Header Injection

zitadel is vulnerable to Host Header Injection attack. The vulnerability is caused due to improper validation of the X-Forwarded-Host header while creating a password reset link. An attacker can phish a user by tampering with X-Forwarded-Host header, retrieve the secret code which can be used to...

CVE-2023-49097 ZITADEL vulnerable account takeover via malicious host header injection

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicio...

Apache Superset Input Validation Error Vulnerability (CNVD-2023-9666130)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An input validation error vulnerability exists in Apache Superset versions prior to 3.0.0. The vulnerability stems from the presence of improper input validation, which can be exploited by an...

ZITADEL Authorization Issues Vulnerability

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless in the Swiss ZITADEL open source. An authorization issue vulnerability exists in ZITADEL versions prior to 2.41.6, prior to 2.40.10, and prior to 2.39.9,...

GHSA-2WMJ-46RJ-QM2W ZITADEL Account Takeover via Malicious Host Header Injection

Impact ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code c...

ZITADEL Account Takeover via Malicious Host Header Injection

Impact ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code c...

Apache Superset Open Redirect vulnerability

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0...

GHSA-HC74-9VJM-C9XV Apache Superset Open Redirect vulnerability

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0...

CVE-2023-42502

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0...

CVE-2023-42502 Apache Superset: Open Redirect Vulnerability

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0...

Apache Superset 输入验证错误漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An input validation error vulnerability exists in Apache Superset versions prior to 3.0.0. The vulnerability stems from the presence of improper input validation, which can be exploited by an...