Delta Electronics CNCSoft-B DOPSoft

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Delta Electronics Equipment : CNCSoft-B DOPSoft Vulnerability : Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code...

PT-2024-1947 · Delta Electronics · Cncsoft-B Dopsoft

Name of the Vulnerable Software and Affected Versions: Delta Electronics CNCSoft-B DOPSoft versions prior to 4.0.0.82 Description: The issue is related to the insecure loading of libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

Cross site scripting

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

Admins Urged to Uninstall VMware EAP Amid Critical Flaws

Summary: VMware has issued a warning to administrators regarding two unaddressed security vulnerabilities necessitating the removal of an outdated authentication plugin. Identified as CVE-2024-22245 and CVE-2024-22250, these vulnerabilities enable session hijacking and authentication relay attack...

Cross-site Websocket Hijacking (CSWSH)

meshcentral is vulnerable to Cross-site Websocket HijackingCSWSH. The vulnerability is due to missing origin checks when using the control.ashx endpoint in MeshCentral. If an attacker can convince an admin end-user to click on a malicious link, they then can access the control.ashx admin panel...

GHSA-CP68-QRHR-G9H8 MeshCentral cross-site websocket hijacking (CSWSH) vulnerability

We have identified a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint of MeshCentral. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. To demonstrate the impact of the vulnerability we developed a...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

PT-2024-19285 · Terminalfour · Terminalfour +1

Name of the Vulnerable Software and Affected Versions: Terminalfour versions 7.4 through 7.4.0004 QP3 Terminalfour versions 8 through 8.3.19 Formbank versions through 2.1.10-FINAL Description: An issue allows Unauthenticated Stored Cross-Site Scripting, potentially leading to Admin Session...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

CVE-2024-22220

CVE-2024-22220 affects Terminalfour and Formbank: unauthenticated stored cross-site scripting can lead to admin session hijacking via the Form Builder and Form Preview. Affected: Terminalfour 7.4–7.4.0004 QP3, Terminalfour 8–8.3.19, and Formbank up to 2.1.10-FINAL. Root cause is XSS in form-relat...

Cross site scripting

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is...

CVE-2024-26135

Vulnerability summary (CVE-2024-26135): MeshCentral versions prior to 1.1.21 have a cross-site websocket hijacking (CSWSH) vulnerability in the control.ashx endpoint. An attacker can lure a victim/admin to a malicious page and originate a cross-site websocket connection to control.ashx, enabling ...

CVE-2024-26135 MeshCentral cross-site websocket hijacking (CSWSH) vulnerability

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is...

CVE-2024-26135 MeshCentral cross-site websocket hijacking (CSWSH) vulnerability

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is...

CVE-2024-26135 MeshCentral cross-site websocket hijacking (CSWSH) vulnerability

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is...

PT-2024-1978 · Unknown · Meshcentral

Name of the Vulnerable Software and Affected Versions: MeshCentral versions prior to 1.1.21 Description: The issue is a cross-site websocket hijacking CSWSH vulnerability within the "control.ashx" endpoint, which is the primary mechanism used to perform administrative actions on the server. This...

VMware Enhanced Authentication Plug-in Security Vulnerability

The VMware Enhanced Authentication Plug-in is part of the VMware Horizon client from VMware, Inc. and is used to provide an additional authentication layer to enhance the security of access to VMware Horizon virtual desktops and applications. A security vulnerability exists in VMware Enhanced...

MeshCentral Security Vulnerability

MeshCentral is a complete web-based remote monitoring and management site for the MeshCentral community. A security vulnerability exists in MeshCentral versions prior to 1.1.21 that stems from the presence of a cross-site websocket hijacking vulnerability...

PT-2024-26692

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.11.1 Description The issue arises from the failure to remove the Authorization header when redirecting across domains, potentially allowing for account hijacking. This occurs when a request with the Authorization...