307 matches found
Collabora Online 跨站脚本漏洞
Collabora Online is an application from Collabora UK. A powerful LibreOffice-based online office that supports all major document, spreadsheet and presentation file formats. A security vulnerability exists in Collabora Online versions prior to 22.05.13, 21.11.9.1, and 6.4.27, which stems from the...
PT-2023-3259 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.13 GLPI versions prior to 10.0.7 Description: The issue is related to a lack of authorization, allowing a user with the Technician profile to view and generate a personal token for a Super-Admin. This can be exploit...
Cross-Site Request Forgery (CSRF)
pimcore/pimcore is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to a lack of login sanitization for the PHPSESSID cookie, which allows an attacker to steal an admin token, and login using it, resulting in sensitive information or remote code execution...
SUSE CVE-2013-1977
OpenStack devstack uses world-readable permissions for keystone.conf, which allows local users to obtain sensitive information such as the LDAP password and admintoken secret by reading the file...
SUSE CVE-2013-2006
OpenStack Identity Keystone Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the 1 admintoken and 2 LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file...
CVE-2022-36223
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account...
CVE-2022-35910
In Jellyfin before 10.8, stored XSS allows theft of an admin access token...
CVE-2022-35910
In Jellyfin before 10.8, stored XSS allows theft of an admin access token...
Jellyfin 跨站脚本漏洞
Jellyfin is a freeware media system. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex and can serve media from a dedicated server to end-user devices through multiple applications. A cross-site scripting vulnerability exists in...
CVE-2022-28605
Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in linkplay antifactory...
CVE-2022-28605
Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in linkplay antifactory...
CVE-2022-28605
Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in linkplay antifactory...
CVE-2022-28605
The CVE-2022-28605 entry concerns Linkplay SDK 1.00, specifically in SoundBar apps, where a hardcoded admin token enables remote attackers to gain admin privileges in the Linkplay antifactory. The vulnerability stems from a hardcoded credential in the SoundBar app integration with the Linkplay SD...
GHSA-RXRM-XVP4-JQVH OpenStack Keystone Sensitive information disclosure via log files
OpenStack Identity Keystone Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the 1 admintoken and 2 LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Linuxfoundation Containerd
PoC for CVE-2022-23648 This is a proof of concept for @fel...
CVE-2021-36166
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties...
CVE-2021-36166
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties...
CVE-2021-25981
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attack...
VulnCheck KEV: CVE-2020-8657
EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token...