CVE-2020-12854

CVE-2020-12854 affects SecZetta NEProfile 3.3.11. An authenticated remote attacker can trigger remote code execution by uploading a specially crafted JPEG as the profile avatar. This is a network-exposed vector with low authentication requirements and high impact (CVE shows high in CVSS‑3.1). Pub...

CVE-2020-12855

CVE-2020-12855 pertains to SecZetta NEProfile 3.3.11, where a Host header injection vulnerability lets an authenticated remote attacker poison the Host header and influence the execution flow of 302 HTTP redirects. The issue affects the HTTP response handling at redirect points and could enable m...