CVE-2021-21745

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click...

CVE-2021-21745

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click...

CVE-2021-21745

CVE-2021-21745 is a ZTE MF971R Referer authentication bypass. Talos documents a flawed Referer-based mitigation in the web API goform_get_cmd_process path where bypassing the Referer check (e.g., by including 127.0.0.1 in the Referer) can grant full API access without proper CSRF protection. A Po...

CVE-2021-21745: Cross-Site Request Forgery (CSRF)

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click...

PT-2021-14756

Name of the Vulnerable Software and Affected Versions ZTE MF971R affected versions not specified Description The issue concerns a Referer authentication bypass vulnerability. An attacker could exploit this by sending a request to the user to click, allowing them to perform illegal authorization...

ZTE MF971R LTE router 授权问题漏洞

The ZTE MF971R is a Cat 6 LTE mobile Wi-Fi router with download speeds up to 300mbps and upload speeds up to 50mbps.The ZTE MF971R is vulnerable to a Referer authentication bypass. An attacker can exploit the vulnerability by sending a click request to the user to perform an illegal authorized...

ZTE MF971R Referer authentication bypass vulnerability

Summary An exploitable Referer mitigation bypass vulnerability exists in ZTE MF971R LTE router version wainnerversion:BDPLKPLMF971R1V1.0.0B06. A specially-crafted HTTP request can bypass Referer-based mitigation. An attacker needs to provide a URL to the victim to trigger the vulnerability. Teste...

Open Redirect in firefly-iii/firefly-iii

Steps: 1. Login in application and and navigate to bill section and create bill and capture the request. Web applications use different techniques to redirect users to the next page. Apps may use URL query parameters, header values, with JavaScript code, or it may be backend code. In case of this...

SRC-2021-0022 : Dedecms ShowMsg Template Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dedecms. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the rendering templates. The issue results from the lac...

Brave Software: Information disclosure-Referer leak

Assigned to: Brave Assigned by: Kirtikumar Anandrao Ramchandani Assigned on: 13/09/2021 Browser information used to test Up to date: Brave 1.29.79 Chromium: 93.0.4577.63 Official Build 64-bit Revision ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@1135 OS Windows 10 OS Version 20...

WS-2021-0618

Information disclosure-Referer leak before 1.34.25...

CVE-2020-19703

A cross-site scripting XSS vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2020-19703

A cross-site scripting XSS vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Cross site scripting

A cross-site scripting XSS vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2020-19703

A cross-site scripting XSS vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

DzzOffice 跨站脚本漏洞

DzzOffice is a platform from IBM DzzOffice in the United States that provides online collaborative office suite functionality. The platform can be used to provide online documents, forms, web disk, presentations and other functions. A security vulnerability exists in the referer parameter of...

PT-2021-10391

Name of the Vulnerable Software and Affected Versions: Dzzoffice version 2.02 Description: A cross-site scripting XSS issue exists in the referer parameter, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For Dzzoffice version 2.02, consider...

CVE-2020-19703: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Cross-site Scripting (XSS) - Reflected in slackero/phpwcms

✍️ Description Reflected xss 🕵️‍♂️ Proof of Concept 'HTTP-REFERER: '.echoempty$ref ? 'unknown' : $ref; 💥 Impact xss bug...

Charity Management System CMS 1.0 - Multiple Vulnerabilities

Exploit Title: Charity Management System CMS 1.0 - Multiple Vulnerabilities Date: 18/08/2021 Exploit Author: Davide 't0rt3ll1n0' Taraschi Vendor Homepage: https://www.sourcecodester.com/users/tips23 Software Link:...