CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

CVE-2025-61136

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...

Account Takeover

Flowise is vulnerable to Account Takeover. The vulnerability is due to the forgot-password endpoint returning a valid password reset tempToken without authentication or verification, which allows an attacker to generate reset tokens for arbitrary users and reset their passwords...

CVE-2025-61132: Unverified Password Change

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

Braindump security vulnerabilities

braindump is a note-taking platform by Lev Lazinskiy Personal Developer. A security vulnerability exists in braindump version 0.4.14, which stems from a password reset component that does not properly validate the Host header, which could lead to password reset poisoning and account takeover...

CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

CVE-2025-61136: Improper Control of Generation of Code

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...

PT-2025-43524

Name of the Vulnerable Software and Affected Versions levlaz braindump version 0.4.14 Description A Host Header Injection flaw exists in the password reset functionality of the software. This allows remote attackers to manipulate the Host header during password reset link generation, specifically...

CVE-2025-61136

The software axewater sharewarez version 2.4.3 contains a Host Header Injection vulnerability within its password reset component. The root cause is the use of Flask's url_for(_external=True) to generate reset links without a fixed SERVER_NAME, allowing remote attackers to manipulate the Host hea...

PT-2025-43492

Name of the Vulnerable Software and Affected Versions RecoverySystem.java affected versions not specified Description A flaw exists in the rebootWipeUserData function within the RecoverySystem.java component. This issue allows for a factory reset of the device while in DSU mode because of a missi...

CVE-2025-61136

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...

SharewareZ security vulnerabilities

SharewareZ is a game folder conversion tool by Axe Personal Developers. A security vulnerability exists in SharewareZ version 2.4.3, which stems from an unfixed SERVERNAME in the password reset component, which could lead to password reset poisoning and account takeover...

CVE-2025-61136

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...

CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

CVE-2025-61132

The note-taking platform levlaz braindump v0.4.14 contains a Host Header Injection vulnerability within its password reset component. The issue arises because Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME, allowing remote attackers to manipulate the Host header...

PT-2025-43525

Name of the Vulnerable Software and Affected Versions axewater sharewarez version 2.4.3 Description A Host Header Injection flaw exists in the password reset functionality of the software. This allows remote attackers to potentially take over accounts by manipulating the Host header during passwo...

PT-2025-51649

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s UFS Universal Flash Storage subsystem, specifically within the ufs-qcom component, related to power-down sequences. During UFS device power down,...

EUVD-2023-60022

In the Linux kernel, the following vulnerability has been resolved: mm/vmemmap/devdax: fix kernel crash when probing devdax devices commit 4917f55b4ef9 "mm/sparse-vmemmap: improve memory savings for compound devmaps" added support for using optimized vmmemap for devdax devices. But how vmemmap...

CVE-2023-53717 wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9kwmirspcallback Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9kwmicmd. The callback writes...