5688 matches found
Code injection
The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless...
CVE-2023-39422
The CVE-2023-39422 issue affects the IRM Next Generation booking engine’s /irmdata/api/ endpoints. The root cause is that HMAC tokens used to authenticate requests are exposed in a client-side JavaScript file, which renders this extra safety mechanism ineffective. Descriptions across sources repe...
PT-2023-26943 · Unknown · Irm Next Generation
Name of the Vulnerable Software and Affected Versions: IRM Next Generation booking engine affected versions not specified Description: The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticate requests using HMAC tokens. However, these tokens are exposed in a...
engine Trust Management Gaps
Internet Reservation Module Booking Engine is a booking platform. A trust management issue vulnerability exists in IRM Next Generation booking engine, which arises from the use of HMAC tokens to authenticate requests, but these tokens are exposed in JavaScript files loaded by the client...
Member Login Script 3.3 - Client-side desync Vulnerability
Title: Member Login Script 3.3 - Client-side desync Author: nu11secur1ty Vendor: https://www.phpjabbers.com/ Reference: https://portswigger.net/web-security/request-smuggling/browser/client-side-desync Description: The server appears to be vulnerable to client-side desync attacks. A POST request...
Member Login Script 3.3 - Client-side desync
Title: Member Login Script 3.3 - Client-side desync Author: nu11secur1ty Date: 08/25/2023 Vendor: https://www.phpjabbers.com/ Reference: https://portswigger.net/web-security/request-smuggling/browser/client-side-desync Description: The server appears to be vulnerable to client-side desync attacks...
The vulnerability of Zoom’s video conferencing software, related to the implementation of security features at the client side, allows attackers to gain unauthorized access to protected information.
The vulnerability of Zoom, a video conferencing software, is related to the implementation of security features at the client side. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
PT-2023-24714 · WordPress · Chilexpress Chilexpress Woo Oficial Plugin
Name of the Vulnerable Software and Affected Versions: Chilexpress Chilexpress woo oficial plugin versions 1.2.9 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the execution of malicious scripts on the...
Why Your AWS Cloud Container Needs Client-Side Security
With increasingly complicated network infrastructure and organizations needing to deploy applications across various environments, cloud containers are necessary for companies to stay agile and innovative. Containers are packages of software that hold all of the necessary components for an app to...
Why Your AWS Cloud Container Needs Client-Side Security
With increasingly complicated network infrastructure and organizations needing to deploy applications across various environments, cloud containers are necessary for companies to stay agile and innovative. Containers are packages of software that hold all of the necessary components for an app to...
social-media-skeleton 安全漏洞
social-media-skeleton is an unfinished social media project implemented in php, css, javascript and html by the individual developer of fobybus. A security vulnerability exists in social-media-skeleton prior to version 1.0.5, which stems from validating password policies only on the client-side...
Mozilla: Stored Xss on bugzilla.mozilla.org via comment edit feature from non-admin to admin.
A stored XSS vulnerability was discovered on the comment edit feature of bugzilla.mozilla.org. This allowed an attacker to execute malicious JavaScript code when an admin attempted to edit a comment. The vulnerability was reported and a bug report was filed...
CVE-2023-4345
Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user...
CVE-2023-4345
Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user...
Design/Logic Flaw
Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user...
CVE-2023-4345 Broadcom RAID Controller web interface is vulnerable client-side control bypass
Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user...
CVE-2023-4345 Broadcom RAID Controller web interface is vulnerable client-side control bypass
Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user...
CVE-2023-4345
CVE-2023-4345 affects Broadcom RAID Controller web interface, describing a client-side control bypass that can lead to unauthorized data access by a low-privileged user. The NVD entry assigns CVSSv3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (base 6.5, MEDIUM) with high confidentiality impact and no ...
Weak Password Requirements
Weak password requirements are password policies that are too lax and allow users to create passwords that are easy to guess or crack. This can make it easier for attackers to gain unauthorized access to accounts and systems. It was discovered that the validation takes place only on the client si...
PT-2023-28824 · Broadcom · Broadcom Raid Controller
Name of the Vulnerable Software and Affected Versions: Broadcom RAID Controller affected versions not specified Description: The Broadcom RAID Controller web interface is vulnerable to a client-side control bypass, which can lead to unauthorized data access for low-privileged users...