CVE-2025-63226: Insufficient Session Expiration

The Sencore SMP100 SMP Media Platform firmware versions V4.2.160, V60.1.4, V60.1.29 is vulnerable to session hijacking due to improper session management on the /UserManagement.html endpoint. Attackers who are on the same network as the victim and have access to the target's logged-in session can...

CVE-2025-63828: URL Redirection to Untrusted Site

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...

HPE Aruba Networking AOS-CX 安全漏洞

HPE Aruba Networking AOS-CX is a series of switch devices from HPE America. A security vulnerability exists in the HPE Aruba Networking AOS-CX that stems from a User Authentication Service session hijacking vulnerability that could lead to unauthorized session access...

CVE-2025-63828

Backdrop CMS version 1.32.1 is vulnerable to a Host Header Injection vulnerability due to improper validation of the Host header during password reset requests. An attacker can manipulate this header to redirect users to malicious domains and potentially perform session hijacking via cookie injec...

PT-2025-47395

Name of the Vulnerable Software and Affected Versions Sencore SMP100 SMP Media Platform versions V4.2.160, V60.1.4, V60.1.29 Description The Sencore SMP100 SMP Media Platform is susceptible to session hijacking because of inadequate session management. An attacker on the same network as a logged-...

CVE-2025-63708

Cross-Site Scripting XSS vulnerability exists in SourceCodester AI Font Matcher nid=18425, 2025-10-10 that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly...

PT-2025-47581

Name of the Vulnerable Software and Affected Versions phpPgAdmin versions prior to 7.13.0 Description The software contains multiple cross-site scripting XSS issues across various components. User-supplied input from $ REQUEST parameters is reflected in HTML output without proper encoding or...

CVE-2025-36223

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

PT-2025-46788

Name of the Vulnerable Software and Affected Versions GitLab versions 3.1 through 7.7 Description Multiple vulnerabilities exist in GitLab CE and EE, including Cross-Site Scripting XSS, Information Disclosure, and Prompt Injection. These issues could potentially lead to a compromise of systems. A...

CVE-2025-36223

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2025-36223

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2025-36223 IBM OpenPages Host Header Injection

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2025-36223 IBM OpenPages Host Header Injection

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2025-36223

IBM OpenPages versions 9.0 and 9.1 are affected by a Host header injection vulnerability (CVE-2025-36223) caused by improper validation of HOST header input. The issue could enable attacks such as cross-site scripting, cache poisoning, or session hijacking. Public details across multiple sources ...

CVE-2025-36223: Improper Neutralization of HTTP Headers for Scripting Syntax

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

IBM OpenPages 安全漏洞

IBM OpenPages is an AI-driven, highly scalable Governance, Risk and Compliance GRC solution from International Business Machines IBM. A security vulnerability exists in IBM OpenPages versions 9.0 and 9.1, which stems from improper validation of the HOST header input and could lead to cross-site...

Tenda AC15 安全漏洞

Tenda AC15 is a wireless router from Tenda China. A security vulnerability exists in Tenda AC15 version v15.03.05.18multi, which stems from an authentication cookie that exposes a password hash and uses a low entropy session identifier, which could lead to session hijacking...

PT-2025-53526

Уязвимость платформы управления рисками на предприятии IBM OpenPages связана с недостатками обработки HTTP-запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, осуществить атаку отравления кэша или выполнить перехват сеанса путем отправки специально созданного...

PT-2025-46719

Name of the Vulnerable Software and Affected Versions IBM OpenPages versions 9.0 through 9.1 Description IBM OpenPages versions 9.0 and 9.1 are susceptible to HTTP header injection due to insufficient validation of the HOST headers. This could enable an attacker to perform various attacks against...

Cryptographic Binding Should Not Be Optional: A Formal-Methods Analysis of FIDO UAF Channel Binding

As a case study in cryptographic binding, we present a formal-methods analysis of the cryptographic channel binding mechanisms in the Fast IDentity Online FIDO Universal Authentication Framework UAF authentication protocol, which seeks to reduce the use of traditional passwords in favor of...