38 matches found
CVE-2025-13809
Summary: CVE-2025-13809 affects orionsec orion-ops (SSH Connection Handler) via the MachineInfoController, where manipulating arguments host/sshPort/username/password/authType can trigger server-side request forgery. The vulnerability is described across multiple sources as exploitable from remot...
CVE-2025-4349
A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is possible to initiate the attack remotely. This vulnerability only affects products that are no long...
CVE-2025-4148 Netgear EX6200 sub_503FC buffer overflow
A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub503FC. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not...
CVE-2025-4117
A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub41A914. The manipulation of the argument host leads to buffer overflow. The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2024-7616
Edimax IC-6220DC and IC-5150W (firmware ≤ 3.06) expose a command-injection vulnerability in the ipcam_cgi module, specifically via the cgiFormString function manipulating the host argument. Exploitation could yield unauthorized commands on affected devices. Remediation from the connected sources:...
CVE-2024-7337
A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected by this issue is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument httphost leads to buffer overflow. The attack may be launched remotely. T...
CVE-2024-7157 TOTOLINK A3100R getSaveConfig buffer overflow
A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument httphost leads to buffer overflow. It is possible to initiate the...
CVE-2024-21498
All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...
PT-2024-17332 · Globalscape · Cuteftp
Name of the Vulnerable Software and Affected Versions: Global Scape CuteFTP version 9.3.0.3 Description: A vulnerability was found in Global Scape CuteFTP, classified as problematic. The issue affects some unknown functionality. The manipulation of the argument Host/Username/Password leads to...
CVE-2023-4965
A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been...
Rage quitting availability cannot be reliably guaranteed
Lines of code Vulnerability details Impact The host can block specific rage quits, invalidating some of the security offered by the rage quit functionality. Proof of Concept Rage quitting is only allowed before rageQuitTimestamp or if permanently enabled: // Check if ragequit is allowed. uint40...
Linux kernel 输入验证错误漏洞
Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel 5.16.12 previously had a security vulnerability where the endpoint index was not validated and could be manipulated by the host for out-of-array access. No detailed vulnerability details are...
CVE-2019-9636
It was discovered that python's functions urllib.parse.urlsplit and urllib.parse.urlparse do not properly handle URLs encoded with Punycode/Internationalizing Domain Names in Applications IDNA, which may result in a wrong domain name specifically the netloc component of URL - user@domain:port bei...
Discuz! 多个版本HTTP host头攻击漏洞
简要描述： 怎么没人提交此类漏洞？那就让我先来吧！ 详细说明： http://drops.wooyun.org/papers/1383 首先向James Kettle致敬 下面以Discuz! X3.2为例，作个演示 漏洞证明： 以http://bbs.locojoy.com/为例， 1.易得其ip为 115.29.162.113 2.向hosts添加条目 115.29.162.113 www.evil.com 3.访问http://www.evil.com 找回密码，输入攻击目标的email，提交 4.受害人收到email...
Oracle Database DBMS_AQADM_SYS.GRANT_TYPE_ACCESS Procedure SQL Injection (CVE-2009-0977)
Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages of related program objects, e.g., procedures, functions, variables, constants, cursors, and exceptions, are provided in order to better...
Code injection
A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux RHEL 5, when NPort ID Virtualization NPIV hardware is used, sets world-writable permissions for the 1 vportcreate and 2 vportdelete files under /sys/class/scsihost/, which allows loc...
Oracle Database Trigger MDSYS.SDO_TOPO_DROP_FTBL SQL Injection (CVE-2008-3979)
Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages of related program objects such as procedures, functions, triggers, variables, constants, cursors, and exceptions, are provided in order t...