952 matches found
CVE-2021-25994
CVE-2021-25994 concerns Userfrosting versions v0.3.1–v4.6.2 vulnerable to Host Header Injection. The underlying issue allows an unauthenticated attacker to abuse the forgot-password flow by injecting host header data to reset a user’s password, enabling account takeover. Connected documents corro...
CVE-2021-25994 Userfrosting - Host-Header Injection Leads to Account Takeover
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...
Userfrosting 注入漏洞
Userfrosting is a secure, modern Php user management system. a security vulnerability exists in Userfrosting, which stems from the fact that in Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to a host header injection attack. An attacker could exploit the vulnerability to use the forgot...
Zimbra Cross-Site Scripting Vulnerability
Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...
CVE-2020-18984
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
CVE-2020-18984
A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...
CVE-2020-18984
CVE-2020-18984 describes a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration 8.8.12, specifically in the zimbraAdmin/public/secureRequest.jsp component. The issue allows unauthenticated attackers to execute arbitrary web scripts or HTML through host header injection. The ...
Zimbra 跨站脚本漏洞
Zimbra is an open source email collaboration platform from Zimbra, Inc. Zimbra Collaboration 8.8.12 is vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML via host header injection...
CVE-2021-36322
Dell Networking X-Series firmware versions prior to 3.0.1.8 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary host header values to poison the web-cache or trigger redirections...
CVE-2021-36322
CVE-2021-36322 affects Dell Networking X-Series firmware prior to 3.0.1.8. A host header injection vulnerability allows a remote unauthenticated attacker to inject arbitrary host header values to poison web caches or trigger redirects. Affected component: Dell Networking X-Series firmware (prior ...
Dell Networking X-Series 注入漏洞
Dell Networking X-Series is a series of intelligent managed switches from Dell, U.S. A HOST injection vulnerability exists in Dell Networking X-Series, which can be exploited by remote, unauthenticated attackers to poison web caches or trigger redirects by injecting arbitrary host header values...
PT-2021-21224 · Dell · Dell Networking X-Series
Name of the Vulnerable Software and Affected Versions: Dell Networking X-Series firmware versions prior to 3.0.1.8 Description: The issue allows a remote unauthenticated attacker to potentially exploit the vulnerability by injecting arbitrary host header values to poison the web-cache or trigger...
CVE-2021-25980
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...
CVE-2021-25980
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...
Design/Logic Flaw
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...
CVE-2021-25980
CVE-2021-25980 describes a Host Header Injection vulnerability in Talkyard. Affected versions include v0.04.01–v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e–v0.2021.02-WIP-879ef3fe1, and tyse-v0.2021.02–tyse-v0.2021.28-af66b6905-regular. An unauthenticated attacker can lure a user to click a link...
CVE-2021-25980 Talkyard - Host-Header Injection Leads to Account Takeover
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...
CVE-2021-25980 Talkyard - Host-Header Injection Leads to Account Takeover
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...