9504 matches found
CVE-2021-3113
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...
CVE-2021-3113
Summary: CVE-2021-3113 affects Netsia SEBA+ up to version 0.16.1 build 70-e669dcd7. A direct request to /session/list/allActiveSession can disclose session cookies, potentially exposing an admin’s cookie and enabling admin access if an admin is logged in at the time of the request. Impact (as sta...
CVE-2021-3113
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...
Valve: Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)
Researcher reported an issue where certain secure cookies would be included in a web request initiated through Steam Big Picture mode that was initially to a trusted origin but subsequently forwarded to a site on a different origin...
Anchor CMS 'markdown' cross-site scripting vulnerability
Anchor CMS is a lightweight CMS builder. A cross-site scripting vulnerability exists in Anchor CMS 'markdown', which can be exploited by attackers to obtain sensitive information such as user cookies...
EyesOfNetwork 5.3 - File Upload Remote Code Execution
Exploit Title: EyesOfNetwork 5.3 - File Upload Remote Code Execution Date: 10/01/2021 Exploit Author: Ariane.Blow Vendor Homepage: https://www.eyesofnetwork.com/en Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x8664-bin.iso Version: 5.3-10 12/9/2020-lastest !/bin/bash /!\ You...
Cloud Attacks Are Bypassing MFA, Feds Warn
The Feds are warning that cybercriminals are bypassing multi-factor authentication MFA and successfully attacking cloud services at various U.S. organizations. According to an alert issued Wednesday by the Cybersecurity and Infrastructure Security Agency CISA, there have been “several recent...
CVE-2020-26732
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
Skyworth Gn542vf 安全漏洞
Skyworth Gn542vf is an Internet TV device from Skyworth, a Chinese company. A security vulnerability exists in Skyworth GN542VF Boa version 0.94.13, which can be exploited by an attacker to capture session cookies...
XSS Vulnerability in Autoship System of Zibo Shining Network Technology Co.
Zibo Shining Network Technology Co., Ltd. was established on November 06, 2014 . The company's business scope includes: the development and sale of computer software and hardware, Internet technology development, technical services, network information system integration, web design, network...
IBM Security Guardium Insights Information Disclosure Vulnerability (CNVD-2021-03528)
IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. An information disclosure vulnerability exists in IBM Security Guardium Insights 2.0.2. The vulnerability stems from the product...
CVE-2020-4597
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link a...
CVE-2020-4597
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link a...
Authorization
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link a...
CVE-2020-4597
CVE-2020-4597 affects IBM Security Guardium Insights 2.0.2. The issue is that authorization tokens and session cookies are not marked Secure, allowing cookie exposure via http links or malicious sites and potential traffic snooping. Impact is limited to exposed cookies; no exploit details are pro...
CVE-2020-4597
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link a...
Design/Logic Flaw
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0...
gramho.com Cross Site Scripting vulnerability OBB-1729475
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Viki Solutions Viki Vera Cross-Site Scripting Vulnerability
Viki Solutions Viki Vera is a suite of workflow customization platforms from Canadian company Viki Solutions. The platform supports file uploading, job management, and other features. A security vulnerability exists in Viki Vera 4.9.1.26180, which can be exploited by an attacker to set a user's...
IBM Security Guardium Insights 授权问题漏洞
IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. An information disclosure vulnerability exists in IBM Security Guardium Insights 2.0.2. The vulnerability stems from the product...