5672 matches found
CVE-2023-50454
An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers...
CVE-2023-49674
A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...
CVE-2021-33425
A stored cross-site scripting XSS vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary Javascript in the OpenWRT Hostname via the Hostname Change operation...
CVE-2021-31884
A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and...
CVE-2025-68637
The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle MITM attacks. This...
CVE-2022-23779
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses...
CVE-2022-42979
Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a deep link...
CVE-2017-18407
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...
CVE-2025-64093
Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device...
CVE-2025-64090
This vulnerability allows authenticated attackers to execute commands via the hostname of the device...
CVE-2025-64090
This vulnerability allows authenticated attackers to execute commands via the hostname of the device...
CVE-2025-64093
Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device...
CVE-2025-64093
CVE-2025-64093 is an unauthenticated Remote Code Execution affecting Zenitel ICX500/ICX510 exposed to networks. Public descriptions consistently state an attacker can inject arbitrary commands into the device hostname, enabling remote code execution with no user interaction. The CVSSv3.1 base sco...
CVE-2025-64093 Unauthenticated Remote Code Execution via the device hostname
Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device...
CVE-2025-64093 Unauthenticated Remote Code Execution via the device hostname
Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device...
CVE-2025-64090 Authenticated Remote Code Execution in device hostname
This vulnerability allows authenticated attackers to execute commands via the hostname of the device...
CVE-2025-64090 Authenticated Remote Code Execution in device hostname
This vulnerability allows authenticated attackers to execute commands via the hostname of the device...
CVE-2025-64090
CVE-2025-64090 affects Zenitel ICX500 and ICX510 platforms. Authenticated attackers can execute commands via the device hostname, implying remote code execution tied to hostname handling. Publicly provided details are limited to the vulnerability description; no patch/versioned remediation is spe...
CVE-2020-10212
upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the...