4980 matches found
CVE-2019-1866: Improper Access Control
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a...
CVE-2020-11702
An issue was discovered in ProVide formerly zFTPServer through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter...
Cross site scripting
An issue was discovered in ProVide formerly zFTPServer through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter...
CVE-2020-11702: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ProVide formerly zFTPServer through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter...
Vesta Control Panel and Hestia Control Panel Password Reset Module Information Disclosure Vulnerability
Vesta Control Panel VestaCP is an open source web hosting control panel.Hestia Control Panel is an open source hosting control panel. A security vulnerability exists in the Password Reset Module in VestaCP versions 0.9.8-25 and earlier and Hestia Control Panel versions 1.1.0 and earlier. An...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
Design/Logic Flaw
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
CVE-2020-10966
Summary (CVE-2020-10966): The vulnerability affects Vesta Control Panel and Hestia Control Panel Password Reset Module. Through versions VestaCP up to 0.9.8-25 (and Hestia up to 1.1.1), an attacker can manipulate the Host header to cause an account takeover, as the reset URL delivered to the vict...
PT-2020-12454
Name of the Vulnerable Software and Affected Versions VESTA Control Panel versions 0.9.8-25 and earlier Hestia Control Panel versions prior to 1.1.1 Description The issue allows for account takeover through Host header manipulation in the Password Reset Module. This occurs because the victim...
CVE-2020-10966: Undefined Security Weakness
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name...
Caldera Access Control Error Vulnerability
Caldera is a suite of software from the French company Caldera that provides color management, imaging and processing solutions for printer devices. An access control error vulnerability exists in authsvc in versions of Caldera prior to 2.6.5, which can be exploited by an attacker to bypass...
CVE-2020-10807
authsvc in Caldera before 2.6.5 allows authentication bypass for REST API requests via a forged "localhost" string in the HTTP Host header...
Authentication flaw
authsvc in Caldera before 2.6.5 allows authentication bypass for REST API requests via a forged "localhost" string in the HTTP Host header...
CVE-2020-10807
authsvc in Caldera before 2.6.5 allows authentication bypass for REST API requests via a forged "localhost" string in the HTTP Host header...
CVE-2020-10807: Authentication Bypass by Spoofing
authsvc in Caldera before 2.6.5 allows authentication bypass for REST API requests via a forged "localhost" string in the HTTP Host header...
PT-2020-2042
Name of the Vulnerable Software and Affected Versions Caldera versions prior to 2.6.5 Description The issue is related to the auth svc function in Caldera, which allows authentication bypass for REST API requests. This can be achieved by forging a "localhost" string in the HTTP Host header,...