985 matches found
CVE-2022-24181
Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...
CVE-2022-24181
Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...
CVE-2022-23701
The CVE-2022-23701 entry concerns HPE Integrated Lights-Out 4 (iLO 4) firmware prior to 2.60, where a remote host header injection could cause the iLO 4 webserver to redirect to an attacker-controlled domain. This finding is corroborated by multiple sources (NVD, Red Hat, CVE List, CNNVD) in the ...
CVE-2021-29872
IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP...
Omise: Host Header Injection leads to Open Redirect and Content Spoofing or Text Injection.
Summary: 1. Open Redirection The https://dashboard.omise.co/test/dashboard website is vulnerable to an Open Redirection flaw if the server receives a crafted X-Forwarded-Host header. Description: Open Redirect is a vulnerability in which the attacker manipulates a web page to redirect the users t...
GHSA-CV25-3GMG-C6M8 Injection in UserFrosting
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Injection in UserFrosting
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Userfrosting has an unspecified vulnerability
Userfrosting is a secure, modern Php user management system. a security vulnerability exists in Userfrosting, which stems from the fact that in Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to a host header injection attack. An attacker could exploit the vulnerability to use the forgot...
CVE-2021-25994
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
CVE-2021-25994
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
CVE-2021-25994
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Design/Logic Flaw
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
CVE-2021-25994
CVE-2021-25994 concerns Userfrosting versions v0.3.1–v4.6.2 vulnerable to Host Header Injection. The underlying issue allows an unauthenticated attacker to abuse the forgot-password flow by injecting host header data to reset a user’s password, enabling account takeover. Connected documents corro...
CVE-2021-25994 Userfrosting - Host-Header Injection Leads to Account Takeover
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Userfrosting 注入漏洞
Userfrosting is a secure, modern Php user management system. a security vulnerability exists in Userfrosting, which stems from the fact that in Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to a host header injection attack. An attacker could exploit the vulnerability to use the forgot...
Zimbra Cross-Site Scripting Vulnerability
Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...
CVE-2020-18984
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
CVE-2020-18984
CVE-2020-18984 describes a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration 8.8.12, specifically in the zimbraAdmin/public/secureRequest.jsp component. The issue allows unauthenticated attackers to execute arbitrary web scripts or HTML through host header injection. The ...
CVE-2020-18984
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...