985 matches found
CVE-2024-42903
A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain...
CVE-2024-42914
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...
CVE-2024-42914
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...
CVE-2024-42915
A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts...
PT-2024-30204 · Unknown · Staff Appraisal System
Name of the Vulnerable Software and Affected Versions: Staff Appraisal System version 1.0 Description: A host header injection vulnerability in the Staff Appraisal System allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This enables...
CVE-2024-42914
ArrowCMS 1.0.0 is affected by a host header injection in the forgot password feature. A crafted Host header can cause password reset links to be sent to an attacker-controlled server, leaking the reset token and potentially allowing the attacker to reset other users’ passwords. The connected sour...
Staff Appraisal System 安全漏洞
Staff Appraisal System is an employee appraisal system by Debashish Choudhury, an individual developer. A security vulnerability exists in Staff Appraisal System v1.0, which stems from a host header injection vulnerability that can be exploited by an attacker to obtain a password reset token...
CVE-2024-42914
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...
CVE-2024-42915
Summary: CVE-2024-42915 is a host header injection vulnerability in Staff Appraisal System v1.0. Affected component: the password reset flow within Staff Appraisal System. Root cause/impact: attackers can induce a user to click a crafted password reset link to obtain a password reset token, enabl...
CVE-2024-42915
A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts...
CVE-2024-42914
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...
PT-2024-30203 · Arrowcms · Arrowcms
Name of the Vulnerable Software and Affected Versions: ArrowCMS version 1.0.0 Description: A host header injection vulnerability exists in the forgot password functionality. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to...
ArrowJS CMS 安全漏洞
ArrowJS CMS is a CMS based on ArrowJS framework by Trần Quốc Cường individual developer. A security vulnerability exists in ArrowJS CMS version 1.0.0, which originates from a host header injection issue in the forgot password feature. By sending a specially crafted host header in the forgot...
RubyGems: Host Header Attac
The application was vulnerable to a Host Header Injection vulnerability. The Host header was manipulated to redirect users to arbitrary domains or potentially poison web caches...
PT-2024-9646 · Dell · Dell Ecs
Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.0 Description: The issue is related to a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that lead to sensitive...
BIT-SUITECRM-2024-36419 SuiteCRM-Core Host Header Injection in /legacy
SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...
CVE-2024-36419
SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...
CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy
SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...
CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy
SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...
CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy
SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...