NETGEAR JWNR2000 注入漏洞

The NETGEAR JWNR2000v2 is a wireless router from NETGEAR. The NETGEAR JWNR2000v2 suffers from a command injection vulnerability that stems from the cmdwireless function parameter host failing to properly filter constructor command special characters, commands, and so on. No details of the...

NETGEAR WG302v2 注入漏洞

The NETGEAR WG302v2 is a wireless access point from NETGEAR. The NETGEAR WG302v2 suffers from a command injection vulnerability that stems from the uigetinputvalue function parameter host failing to properly filter constructor command special characters, commands, and so on. No details of the...

NETGEAR JWNR2000 安全漏洞

The NETGEAR JWNR2000v2 is a wireless router from NETGEAR. The NETGEAR JWNR2000v2 suffers from a buffer overflow vulnerability that originates from the getcurlangver function parameter host failing to correctly validate the length of the input data, which can be exploited by an attacker to execute...

Authorization Bypass

leantime/leantime is vulnerable to an Authorization Bypass. The vulnerability is due to missing authorization checks on the "Host" parameter, allowing an attacker to access another user's profile information by modifying the parameter...

The vulnerability of the getSaveConfig() function in TOTOLINK CP450 router microprogramming software allows a hacker to induce a service failure.

The vulnerability of the getSaveConfig function in TOTOLINK CP450 router microprogramming software is related to the issue of the operation going beyond the buffer in memory when processing the httphost parameter. Exploiting this vulnerability could allow a remote attacker to cause service...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper authorization checks on the Host parameter. An attacker can view profile information of other users by manipulating the Host parameter. Remediation Upgrade leantime/leantime to version 3.3 or higher...

GHSA-3HFJ-QCVJ-4HX8 Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

PT-2025-7637 · Unknown · Application

Name of the Vulnerable Software and Affected Versions: Application affected versions not specified Description: The issue concerns the lack of authorization checks for the Host parameter, allowing unauthorized access to view profile information of other users. An attacker can exploit this by...

NETGEAR R7000P和NETGEAR R6900P 安全漏洞

The NETGEAR R6900P and R7000P are wireless routers from NETGEAR that provide high-speed Internet connectivity and network management capabilities. The NETGEAR R6900P and R7000P suffer from a buffer overflow vulnerability that stems from the sub16C4C function in the HTTP Header Handler component...

The vulnerability of the “host” parameter in the web interface for controlling Zyxel network devices allows a perpetrator to execute arbitrary commands.

The vulnerability of the host parameter in the web interface for controlling Zyxel network devices is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-9200

A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15ABQA.2.2C0 could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable devi...

CVE-2024-9200

CVE-2024-9200 describes a post-authentication command injection in the Zyxel VMG4005-B50A diagnostic function via the vulnerable host parameter. A user with administrator privileges can trigger OS commands on the device. Affected firmware: through V5.15(ABQA.2.2)C0. Root cause: lack of input hand...

CVE-2024-25253

Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module...

CVE-2024-25253

The CVE-2024-25253 entry concerns Driver Booster v10.6, where a buffer overflow was found in the Host parameter under the Customize proxy module. This is described across multiple sources as the underlying issue. The vulnerability is reported with a Network attack vector, no user interaction, and...

IObit Driver Booster 安全漏洞

IObit Driver Booster is a driver updater from IObit. A security vulnerability exists in IObit Driver Booster version v10.6, which stems from a buffer overflow issue that was found to be contained via the Host parameter under the Custom Agent module...

Synology DiskStation Manager Cross-site Scripting (CVE-2018-8917)

Cross-site scripting XSS vulnerability in info.cgi in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

GHSA-JQ3F-MFMG-747X Eclipse Glassfish improperly handles http parameters

In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is /management/domain. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal...

PT-2024-39578 · Eclipse · Eclipse Glassfish

Name of the Vulnerable Software and Affected Versions: Eclipse Glassfish versions prior to 7.0.17 Description: The Host HTTP parameter could cause the web application to redirect to the specified URL when the requested endpoint is "/management/domain". By modifying the URL value to a malicious...

CVE-2024-9004

A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/BackupServercommit.php. The manipulation of the argument host leads to os command injection. It is possible to launch the attack remotely. The exploi...