Created from vulnerability 18281 relation agent
共找到 3 条公开漏洞记录
Detected The Heimdall Application Dashboard was accessible without authentication.When it was deployed without the protection, the full dashboard-including all linked internal services and API credentials-was accessible to unauthenticated users.
LinuxServer.io Heimdall 2.6.3-ls307 contains a host header injection caused by improper validation of user-supplied HTTP headers `X-Forwarded-Host` and `Referer`, letting unauthenticated remote attackers perform host header injection and open redirect attacks, exploit requires no special privileges.
LinuxServer.io Heimdall < 2.7.3 contains a stored XSS caused by improper sanitization of the \"q\" parameter, letting remote attackers execute scripts, exploit requires crafted input.