TeamViewer Desktop Clients Before 15.81.5 Path Traversal

TeamViewer Desktop Clients before version 15.81.5 contain a path traversal flaw in file transfer that may allow an authenticated remote session participant to write files outside the selected download directory...

Cisco ASA Credentials Management Errors (CVE-2019-1714)

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated,...

Cisco ASA Uncontrolled Resource Consumption (CVE-2020-3572)

A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a memory...

A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS.(CVE-2026-87664)

: A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication IPC storage callbacks, the service accepts and registers session structures including administrative ro...

Command Injection Vulnerabilities in Brocade Fabric OS Management Interface and Authentication Workflows

: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...

Brocade Fabric OS command injection vulnerability in PAM session cleanup routines (CVE-2026-94579)

: An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

Rocky Linux 9.6 [TuxCare] Security Update: dbus-broker (ALMALINUX9.6:CLSA-2026:1791316945)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791316945 advisory. - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably...

AlmaLinux 9.6 [TuxCare] Security Update: dbus-broker (ALMALINUX9.6:CLSA-2026:1791316945)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791316945 advisory. - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably...

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

EUVD-2026-88981

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup...

GHSA-WFPM-5GCM-94CG Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

adaPwn

adaPwn - CVE-2019-14912 PoC adAS OPENSSO 모듈이 리다이렉트할 도메인을 올바르게 검증하지 않아, 사용자를 공격자가 제어하는 웹사이트로 리다이렉트하고, 그의 adAS 세션 쿠키를 탈취할 수 있습니다. 사용법 usage: adaPwn.py -h --interface INTERFACE --httpPort HTTPPORT --dnsPort DNSPORT ipToSpoof realIP redirectUrl ipBlacklist ipBlacklist...

CVE-2026-105785 Joplin Server password reset accepts tokens issued for unrelated purposes

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-105785 Joplin Server password reset accepts tokens issued for unrelated purposes

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-105785 Joplin Server password reset accepts tokens issued for unrelated purposes

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

EUVD-2026-92872

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-105785

Prior to Joplin Server 3.7.2 , a vulnerability exists in the TokenModel.ts and UserModel.ts components. The system stores CSRF, account-confirmation, email-change, and password-reset tokens without distinguishing their specific purposes. This allows an attacker to use a leaked CSRF or confirmatio...

CVE-2021-40223

CVE-2021-40223 애플리케이션 : Rittal CMC PU III 웹 관리 장치 : CMC PU III 7030.000 소프트웨어 개정판 : V3.11.002 하드웨어 개정판 : V3.00 공격 유형 : 저장형 XSS 해결 방법 : 소프트웨어 개정판 V3.17.10 이상으로 업데이트 요약 : 웹 애플리케이션이 보안 사용자 구성 대화상자 및 작업 탭에서 사용자 입력을 삭제sanitize하지 못합니다. 이로 인해 공격자는 웹 애플리케이션에 HTML 또는 브라우저 해석 콘텐츠를 주입할 수 있습니다. 이 경우 사용자 구성의...

CVE-2023-43317

CVE-2023-43317 通常のユーザーがSession StorageコンポーネントのuserPermissionsLIstパラメータを介して権限を昇格させ、管理レベルのリソースや機能に不正アクセスすることができます。これにより、管理者に通常制限されているデータへの不正アクセス、データの改ざん、その他の操作が行われる可能性があります。 脆弱な製品:- Coign Card 脆弱なバージョン:- 06.06 参考文献:- https://nvd.nist.gov/vuln/detail/CVE-2023-43317 再現手順 1. 通常のユーザーアカウントでログインします。 2...

CVE-2026-36392

CVE-2026-36392: RISE CRMのアイテムタイトルフィールドにおける格納型XSS 概要 RISE CRM（RISE - Ultimate Project Manager & CRM）バージョン= 3.9.6のアイテムタイトルフィールドに、格納型クロスサイトスクリプティング（XSS）の脆弱性が存在します。認証された管理者がアイテムのタイトルに任意のJavaScriptを注入でき、これはサーバー側に保存され、ストアページを訪れるクライアントユーザーのブラウザで実行されます。これにより、セッションハイジャック、アカウント乗っ取り、フィッシングが可能になります。 詳細 フィールド...