TrueConf Server 跨站脚本漏洞

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server is vulnerable to a cross-site scripting vulnerability that originates from unknown code in the file /admin/conferences/get-all-status/, with the parameter...

Cross-site Scripting (XSS)

Overview modx/revolution is a Content Management System. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getProfilePhoto function in the core/model/modx/moduser.class.php file. An attacker can execute arbitrary scripts in the context of a user's browser sessio...

CVE-2022-23165

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...

Cross site scripting

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...

Session Hijacking

org.wso2.carbon:org.wso2.carbon.ui is vulnerable to session hijacking. When a victim is tricked to submit a specifically crafted Try It request to an attacker-controlled server, a valid Carbon Management Console session cookie is exposed which helps the attacker to hijack the browser session...

Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)

Exploit Title: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting XSS Exploit Author: LiquidWorm enteliTouch XSS input...

Delta Controls enteliTOUCH 3.40.3935 Cross Site Scripting Vulnerability

enteliTouch XSS alertdocument.cookie" / input type="hidden" n...

GateManager跨站脚本漏洞

Secomea GateManager is a remote access server product from Secomea, Denmark. A security vulnerability exists in Secomea GateManager that allows a logged in user to inject javascript during a browser session...

CVE-2022-25311

A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This coul...

PT-2022-17204 · Siemens · Sinema Server +1

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions 1.0.3 and later through versions prior to 2.0 SINEC NMS versions prior to 1.0.3 SINEMA Server V14 all versions Description: The issue arises from the affected software's failure to properly check privileges between users...

CVE-2022-25311

A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This coul...

CVE-2022-25311

The CVE-2022-25311 issue is an improper privilege management flaw in Siemens SINEC NMS (versions around 1.0.3 and SINEMA Server V14) where privileges are not correctly checked between users within the same browser session, enabling a authenticated low-privilege user to escalate privileges. Connec...

CVE-2021-41247 incomplete logout in JupyterHub

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials for the single-user server only, not the Hub reinstated...

JupyterHub 代码问题漏洞

JupyterHub is a multi-user server for Jupyter. A security vulnerability exists in JupyterHub that stems from the fact that in affected versions, users with multiple JupyterLab tabs open in the same browser session may see an incomplete logout from a single-user server because the new credentials...

PT-2021-23211 · Unknown · Jupyterlab +1

Name of the Vulnerable Software and Affected Versions: JupyterHub versions prior to 1.5 Description: The issue affects users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session. When logging out, fresh credentials for the single-user server are...

Adobe Connect <= 11.2.3 Multiple Arbitrary Code Execution Vulnerabilities (APSB21-91)

The version of Adobe Connect installed on the remote host is prior to 11.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb21-91 advisory. - Adobe Connect version 11.2.3 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacke...

RabbitMQ < 3.8.18 XSS

Pivotal RabbitMQ versions prior to 3.8.18 are affected by a cross-site scripting XSS vulnerability in the rabbitmqfederationmanagement plugin due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user ...

Cisco Web Security Appliance XSS (cisco-sa-wsa-xss-mVjOWchB)

According to its self-reported version, Cisco Web Security Appliance is affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit, by convincing a user to click a specially...

Cisco Firepower Management Center Software Multiple XSS (cisco-sa-fmc-xss-yT8LNSeA)

The version of Cisco Firepower Management Center FMC installed on the remote host is affected by multiple cross-site scripting XSS vulnerabilities due to insufficient validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincin...

CVE-2020-21993

In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site...