CVE-2024-1646: Authentication Bypass Using an Alternate Path or Channel

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized...

CVE-2023-7219

A vulnerability has been found in Totolink N350RT 9.3.5u.6139B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument httphost leads to stack-based buffer overflow. The attack can be launched...

CVE-2022-39822

In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation...

CVE-2022-39822

In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation...

KodExplorer Cross-Site Scripting Vulnerability

KodExplorer is a web file manager by the individual developer warlee. A cross-site scripting vulnerability exists in KodExplorer version 4.51, which stems from the APPHOST parameter in config/i18n/en/main.php, which can be used to obtain sensitive information and elevate privileges...

CVE-2023-36950

TOTOLINK X5000R V9.1.0u.6118B20201102 and TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow via the httphost parameter in the function loginAuth...

CVE-2023-36950

TOTOLINK X5000R V9.1.0u.6118B20201102 and TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow via the httphost parameter in the function loginAuth...

CVE-2023-36340

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a stack overflow via the httphost parameter in the function loginAuth...

PT-2023-25751 · Totolink · Totolink X5000R +1

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0u.6118 B20201102 TOTOLINK A7000R version 9.1.0u.6115 B20201022 Description: A stack overflow issue was discovered via the http host parameter in the loginAuth function. This issue affects the login authentication...

TOTOLINK NR1800X Buffer Error Vulnerability

TOTOLINK NR1800X is an outstanding 5G NR indoor Wi-Fi and SIP CPE from China's Gion Electronics TOTOLINK.Designed to provide fast and easy deployment of NR Fixed Data Services for homes and offices. A security vulnerability exists in TOTOLINK NR1800X version V9.1.0u.6279B20210910 and prior...

Cambium Networks Enterprise Wi-Fi System Software Security Vulnerability

Cambium Networks Enterprise Wi-Fi System Software is a simple yet sophisticated platform and tool for planning, deploying, and managing networks from Cambium Networks, USA. A security vulnerability exists in Cambium Networks Enterprise Wi-Fi System Software versions prior to 6.4.2 that stems from...

PT-2023-25418 · Tamronos · Tamronos

Name of the Vulnerable Software and Affected Versions: TamronOS versions up to 20230703 Description: A critical issue has been found, affecting an unknown part of the file "/api/ping". The manipulation of the host argument leads to os command injection, allowing remote attacks. The issue has been...

TamronOS 操作系统命令注入漏洞

TamronOS is an IPTV system from China's TamronOS. An OS command injection vulnerability exists in TamronOS versions prior to 20230703, which stems from an incorrect manipulation of the host parameter resulting in OS command injection...

SUSE CVE-2009-4024

Argument injection vulnerability in the ping function in Ping.php in the NetPing package before 2.4.5 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: this has also been reported as a shell metacharacter problem...

SUSE CVE-2009-4025

Argument injection vulnerability in the traceroute function in Traceroute.php in the NetTraceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information...

SUSE CVE-2011-4782

Cross-site scripting XSS vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter...

SUSE CVE-2019-18860

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

snoyberg Keter 跨站脚本漏洞

snoyberg Keter is Michael Snoyman's personal developer's deployment system for web applications, originally used to host Yesod applications. A cross-site scripting vulnerability exists in snoyberg Keter version 1.8.1 and prior versions, which stems from cross-site scripting due to incorrect...

CVE-2022-3189

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a...

Design/Logic Flaw

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a...