9510 matches found
CVE-2019-1000015
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting XSS vulnerability in main/messages/newmessage.php, main/social/personaldata.php, main/inc/lib/TicketManager.php, main/ticket/ticketdetails.php that can result in a message being sent to the Administrator with the XSS t...
CVE-2019-1000015
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting XSS vulnerability in main/messages/newmessage.php, main/social/personaldata.php, main/inc/lib/TicketManager.php, main/ticket/ticketdetails.php that can result in a message being sent to the Administrator with the XSS t...
Cross site scripting
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting XSS vulnerability in main/messages/newmessage.php, main/social/personaldata.php, main/inc/lib/TicketManager.php, main/ticket/ticketdetails.php that can result in a message being sent to the Administrator with the XSS t...
CVE-2019-1000015
Chamilo LMS (version 1.11.8 and earlier) contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, and main/ticket/ticket_details.php. The issue can cause a message to be sent to the Administrator with an X...
DEBIAN-CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...
CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...
CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...
Session fixation
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...
UBUNTU-CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...
CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...
Semrush: XSS Reflected on my_report
Еще раз привет. На этот раз, кроме HTML-инъекции проходит полноценный XSS в дашбоарде пользователя. Payload: https://www.semrush.com/myreports/api/v1/document%22%3E%3Cimg%20src=x%20onerror=alertdocument.cookie%3E/4007861 PoC: На скрине Impact Кража сессионных куков...
New Mac Malware Targets Cookies to Steal From Cryptocurrency Wallets
Mac users need to beware of a newly discovered piece of malware that steals their web browser cookies and credentials in an attempt to withdraw funds from their cryptocurrency exchange accounts. Dubbed CookieMiner due to its capability of stealing cookies-related to cryptocurrency exchanges, the...
New Mac Malware Targets Cookies to Steal From Cryptocurrency Wallets
Mac users need to beware of a newly discovered piece of malware that steals their web browser cookies and credentials in an attempt to withdraw funds from their cryptocurrency exchange accounts. Dubbed CookieMiner due to its capability of stealing cookies-related to cryptocurrency exchanges, the...
Pages For Bitbucket Server 2.6.0 Cross Site Scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2018-037 Product: Pages for Bitbucket Server Manufacturer: Simplenia AG Affected Versions: 2.6.0 and before Tested Versions: 2.6.0 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufactur...
Qingdao Shangzhixin Network Technology Co., Ltd. website builder system has xss vulnerability
Qingdao Business to letter network technology limited company is a professional engaged in e-commerce, network marketing, software development, IDC and related network value-added services of high-tech specialized companies. There is an xss vulnerability in Qingdao Shangzhixin Network Technology...
GHSA-9GQG-3FXR-9HV7 Apache Airflow vulnerable to XSS
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system...
Linux: TCP SYN Cookies
Normally, a client sends a SYN to the server which responds and hold state information in the TCP stack. In a SYN flood, the generated SYN packets consume all available TCP memory leading the server to deny service. The TCP SYN cookie is a mechanism to resist such SYN flood attacks. This script...
Design/Logic Flaw
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the...
CVE-2017-17836
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the...
CVE-2017-17836
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the...