Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper authorization checks on the Host parameter. An attacker can view profile information of other users by manipulating the Host parameter. Remediation Upgrade leantime/leantime to version 3.3 or higher...

GHSA-3HFJ-QCVJ-4HX8 Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

PT-2025-7637 · Unknown · Application

Name of the Vulnerable Software and Affected Versions: Application affected versions not specified Description: The issue concerns the lack of authorization checks for the Host parameter, allowing unauthorized access to view profile information of other users. An attacker can exploit this by...

NETGEAR R7000P和NETGEAR R6900P 安全漏洞

The NETGEAR R6900P and R7000P are wireless routers from NETGEAR that provide high-speed Internet connectivity and network management capabilities. The NETGEAR R6900P and R7000P suffer from a buffer overflow vulnerability that stems from the sub16C4C function in the HTTP Header Handler component...

Zyxel host Command Execution

The vulnerability of the host parameter in the web interface for controlling Zyxel network devices is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-9200

A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15ABQA.2.2C0 could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable devi...

CVE-2024-9200

CVE-2024-9200 describes a post-authentication command injection in the Zyxel VMG4005-B50A diagnostic function via the vulnerable host parameter. A user with administrator privileges can trigger OS commands on the device. Affected firmware: through V5.15(ABQA.2.2)C0. Root cause: lack of input hand...

CVE-2024-9200: Improper Neutralization of Special Elements used in an OS Command

A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15ABQA.2.2C0 could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable devi...

CVE-2024-25253

Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module...

CVE-2024-25253

IObit Driver Booster version 10.6 contains a buffer overflow vulnerability (CWE-120) within the Customize proxy module . The issue is triggered via the Host parameter , specifically involving a buffer copy without checking the input size. This vulnerability can lead to high availability impact as...

CVE-2024-25253: Buffer Copy without Checking Size of Input

Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module...

IObit Driver Booster 安全漏洞

IObit Driver Booster is a driver updater from IObit. A security vulnerability exists in IObit Driver Booster version v10.6, which stems from a buffer overflow issue that was found to be contained via the Host parameter under the Custom Agent module...

PT-2024-20848

Name of the Vulnerable Software and Affected Versions Driver Booster version 10.6 Description A buffer overflow issue was discovered in the Customize proxy module via the Host parameter. Recommendations For Driver Booster version 10.6, consider disabling the Customize proxy module until a patch i...

Synology DiskStation Manager Cross-site Scripting (CVE-2018-8917)

Cross-site scripting XSS vulnerability in info.cgi in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

GHSA-JQ3F-MFMG-747X Eclipse Glassfish improperly handles http parameters

In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is /management/domain. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal...

PT-2024-39578 · Eclipse · Eclipse Glassfish

Name of the Vulnerable Software and Affected Versions: Eclipse Glassfish versions prior to 7.0.17 Description: The Host HTTP parameter could cause the web application to redirect to the specified URL when the requested endpoint is "/management/domain". By modifying the URL value to a malicious...

CVE-2024-9004

A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/BackupServercommit.php. The manipulation of the argument host leads to os command injection. It is possible to launch the attack remotely. The exploi...

D-Link DAR-7000 操作系统命令注入漏洞

D-Link DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. An OS command injection vulnerability exists in the D-Link DAR-7000 20240912 and earlier versions, which stems from the parameter host in the file /view/DBManage/BackupServercommit.php that can lead to OS command...

CVE-2024-7312 REST Interface Link Redirection via Host parameter

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Payara Platform Payara Server REST Management Interface modules allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before...