CVE-2018-15700

The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Referer field...

CVE-2018-17130

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,...

Design/Logic Flaw

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,...

CVE-2018-17130

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,...

PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2018-19539)

PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A cross-site scripting vulnerability exists in PHPMyWind version 5.5. A remote attacker can exploit this vulnerability to obtain an administrator cookie and perform other actions with the help of th...

PT-2018-13911

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via an HTTP Referer header in the member.php file. Recommendations For PHPMyWind version 5.5, update the member.php file to properly...

CVE-2018-17130: Improper Neutralization of Input During Web Page Generation

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,...

CVE-2018-14398

An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake login page in order to steal credentials...

CVE-2018-14398

The CVE-2018-14398 entry affects Creme CRM 1.6.12: the cancel button’s value is sourced from the HTTP Referer header, enabling potential redirection to a fraudulent login page to steal credentials. Affected component: web UI logic handling cancel navigation; root cause: using Referer content in U...

PT-2018-12489

Name of the Vulnerable Software and Affected Versions Creme CRM version 1.6.12 Description An issue was discovered where the value of the cancel button uses the content of the HTTP Referer header. This could be used to trick a user into visiting a fake login page in order to steal credentials...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19090)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the admincp.php file in version 7.0.11 of idreamsoft iCMS. The vulnerability stems from the detection of CSRFTOKEN when it does not exist, and the program...

CVE-2018-16314

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

Crlf injection

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

CVE-2018-16314

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

CVE-2018-16314: Cross-Site Request Forgery (CSRF)

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

PT-2018-13483

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.11 Description An issue was discovered in the admincp.php file. When verifying the CSRF TOKEN, if the CSRF TOKEN does not exist, only the Referer header is validated. This validation can be bypassed by including an...

CVE-2018-12457

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header...

CVE-2018-12457: Incorrect Permission Assignment for Critical Resource

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header...

PT-2018-11188

Name of the Vulnerable Software and Affected Versions Express-Cart versions prior to 1.1.6 Description The issue allows remote attackers to create an admin user via a "/admin/setup" API endpoint by manipulating the Referer header. Recommendations For versions prior to 1.1.6, update to version 1.1...

CVE-2018-11714

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of...