316 matches found
Code injection
An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI...
CVE-2017-14445
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to...
PT-2018-5646 · Insteon · Insteon Hub
Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: A buffer overflow issue exists due to the incorrect handling of the host parameter by the HTTP server implementation during a firmware update request. This leads to a buffer overflow on a global section. ...
BSA-2018-604
Security Advisory ID : BSA-2018-604 Component : System Revision : 1.0: Final Multiple GPON Home Routers could allow a remote attacker to execute arbitrary commands on the system, caused by the ping and trace route commands running at root level on the diagnostic page. An attacker could exploit th...
PT-2018-2613
Name of the Vulnerable Software and Affected Versions Dasan GPON Routers affected versions not specified Description An issue was discovered on Dasan GPON home routers where Command Injection can occur via the dest host parameter in a "diag action=ping" request to a "GponForm/diag Form" URI. The...
The vulnerability of the Microsoft HeartbeatCtl ActiveX control implemented in Internet Explorer allows a hacker to execute arbitrary code.
The vulnerability of the Microsoft HeartbeatCtl ActiveX control HRTBEAT.OCX in Internet Explorer is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the “Host” parameter...
EyesOfNetwork web interface 'host' parameter SQL injection vulnerability
EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. The EyesOfNetwork web interface aka eonweb is one of these web interfaces...
CVE-2017-15933
SQL injection vulnerability vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacityperdevice/index.php...
Pure Storage Purity Cross-Site Scripting Vulnerability
Pure Storage Purity is a storage appliance from the American company Pure Storage. A cross-site scripting vulnerability exists in Pure Storage Purity version 4.7.5. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the 'host' parameter...
CVE-2017-7352
Stored Cross-site scripting XSS vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "host" parameter on the 'System Configuration SNMP Add SNMP Trap Manager' screen...
Django two url jump vulnerability analysis: CVE-2017-7233&7234-vulnerability warning-the black bar safety net
! Django official News&Event in the 4 on 4, released a security update that fixes two URL jump loopholes, one is the urlparse pot, the other by long Dinh tech security researcher phithon report, are very beautiful. Because there are replicate Django vulnerability of habit, the evening pumping up...
CVE-2016-6266
cccaajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 host or 2 apikey parameter in a register action, 3 enable parameter ...
SAP SLD Registration Program Denial of Service Vulnerability
The SAP SLD Registration Program SLDREG is a set of tools from SAP Germany for registering SAP systems in the System Architecture Catalog. A security vulnerability exists in SAP SLDREG. A local attacker can exploit this vulnerability to cause a denial of service memory corruption and process...
CVE-2016-3638
SAP SLD Registration Program aka SLDREG allows local users to cause a denial of service memory corruption and process termination via a crafted HOST parameter, aka SAP Security Note 2125623...
Memory corruption
SAP SLD Registration Program aka SLDREG allows local users to cause a denial of service memory corruption and process termination via a crafted HOST parameter, aka SAP Security Note 2125623...
Cisco Jabber Guest Server HTTP HOST Parameter Cross-Site Scripting Vulnerability
Cisco Jabber Guest is a consumer-to-business C2B solution. A cross-site scripting vulnerability in Cisco Jabber Guest's handling of the HTTP HOST parameter allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive...
Pimcore /reports/newsletter/send HOST parameter command execution vulnerability
Pimcore is a purely object-oriented system based on the Zend Framework, written in PHP 5. Pimcore /reports/newsletter/send fails to properly handle the 'HOST' GET parameter, allowing remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary commands...
CVE-2014-4329
Cross-site scripting XSS vulnerability in lua/hostdetails.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter...