156 matches found
CVE-2025-1731
An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting...
Absolute Secure Access 安全漏洞
Absolute Secure Access is an application from Absolute, Inc. to provide Secure Service Edge SSE optimized for hybrid and mobile working models. A security vulnerability exists in Absolute Secure Access versions prior to 13.53, which stems from a cross-site scripting vulnerability in the Secure...
CVE-2025-1239
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS allows Stored XSS via the Blocked Sites list. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Firewa...
CVE-2025-1239
A stored cross-site scripting XSS vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox...
CVE-2025-1239
WatchGuard Fireware OS (WatchGuard Firebox) is affected by CVE-2025-1239. Affected versions are Fireware OS 12.0–12.5.12+701324 and 12.6–12.11. The issue is an improper neutralization of input during web page generation, enabling Stored XSS via the Blocked Sites list. An authenticated administrat...
CVE-2025-1071
The CVE-2025-1071 issue affects WatchGuard Fireware OS (Firebox) with the spamBlocker module, where improper input neutralization during web page generation enables Stored XSS. The vulnerability requires an authenticated administrator session to a locally managed Firebox and affects Fireware OS v...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi version v4.8.0, which originates from allowing an unauthorized attacker to view an administrator's session ID in System Monitor...
CVE-2024-29976
UNSUPPORTED WHEN ASSIGNED The improper privilege management vulnerability in the command “showallsessions” in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an authenticated attacker to obtain a logged-in administrator’s session...
VulnCheck KEV: CVE-2014-100005
D-Link DIR-600 routers contain a cross-site request forgery CSRF vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session...
xzs-mysql 安全漏洞
xzs-mysql is an open source front-end and back-end separation of the examination system by Mindskip Technology mindskip. A security vulnerability exists in xzs-mysql version 3.8, which stems from the presence of a session expiration insufficiency issue that allows an attacker to take advantage of...
UC Software - Use of Insufficiently Random Values
A potential vulnerability was discovered in certain Poly devices. A potential flaw allows an attacker to predict a session and piggyback onto an active administrator session of the web server. The potential vulnerability is dependent on the administrator maintaining an active session. HP has...
CVE-2023-4677
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...
CVE-2023-4677
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...
Design/Logic Flaw
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...
CVE-2023-4677 Unauthenticated Admin Account Takeover Via Cron Log File Backups
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...
CVE-2023-26258
Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute a...
CVE-2023-23326
A Stored Cross-Site Scripting XSS vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an...
SUSE CVE-2011-0703
In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session...
SUSE CVE-2015-5335
Cross-site request forgery CSRF vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub U...
PT-2022-25579 · Thinkcmf · Thinkcmf
Name of the Vulnerable Software and Affected Versions: ThinkCMF version 6.0.7 Description: The issue allows an attacker to inject a Persistent XSS payload in the Slideshow Management section, executing arbitrary JavaScript code on the client side. This could be used to steal the administrator's P...