19041 matches found
CVE-2025-52553
CVE-2025-52553 affects authentik (open-source identity provider). The vulnerability arises from a session-specific, single-use token generated after authorizing access to a RAC endpoint that is embedded in the URL; the check ensuring the token is valid only for the originating user’s session is m...
PT-2025-27232
Name of the Vulnerable Software and Affected Versions: authentik versions prior to 2025.4.3 authentik versions prior to 2025.6.3 Description: The issue arises from the way authentik handles tokens after authorizing access to a RAC endpoint. A token is created for a single connection and sent to t...
CVE-2025-48463
Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...
CVE-2025-48470
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...
PT-2025-26852 · C3Crm · C3Crm
Name of the Vulnerable Software and Affected Versions: c3crm versions up to 3.0.4 Description: A cross-site scripting XSS issue in the /Login.php component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login error parameter. This enables attacke...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : screen (SUSE-SU-2025:02016-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02016-1 advisory. Security issues fixed: - CVE-2025-46802: temporary chmod of a user's TTY to mode 0666 when attempting to...
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the...
CVE-2025-48470
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...
CVE-2025-48463
Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...
CVE-2025-48470 Stored Cross site Scripting (XSS)
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...
CVE-2025-48470 Stored Cross site Scripting (XSS)
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...
CVE-2025-48470
CVE-2025-48470 is a stored cross-site scripting (XSS) vulnerability affecting Advantech devices (notably WISE-4010LAN, WISE-4050LAN, WISE-4060LAN per CNNVD). The issue allows an attacker to inject malicious scripts into device fields, which can execute in other users’ browsers and potentially lea...
CVE-2025-48463 Unencrypted HTTP Communication
Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...
CVE-2025-48463 Unencrypted HTTP Communication
Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...
CVE-2025-48463
CVE-2025-48463 concerns unencrypted HTTP leading to data interception and session hijacking. The provided docs confirm this vulnerability affects multiple products/vendors and characterize the impact as possible unauthorised access or data tampering due to cleartext traffic. The NVD/RH Red Hat en...
CVE-2025-34032
CVE-2025-34032 concerns the Moodle LMS Jmol plugin (
Advantech多款产品 安全漏洞
The Advantech WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN are all industrial automation controllers from Advantech of Taiwan, China. An information disclosure vulnerability exists in multiple Advantech products, which can be exploited by attackers to cause data interception and session hijacking...
PT-2025-26682 · Advantech · Advantech Wireless Sensing/Equipment +3
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns a stored cross-site scripting vulnerability. Successful exploitation could allow an attacker to inject malicious scripts into device fields and execute them in other users...
Security update for screen
This update for screen fixes the following issues: CVE-2025-46802: Fixed temporary chown of users' TTY to mode 0666 allowing PTY hijacking bsc1242269 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...
CVE-2025-52557
Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...