Nagios XI Cross-Site Scripting Vulnerability (CNVD-2021-11074)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in /usr/local/nagiosxi/html/admin/sshterm.php in Nagios XI 5.7.5. The vulnerability stems...

CVE-2021-25299

Nagios XI version xi-5.7.5 is affected by cross-site scripting XSS. The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session...

CVE-2021-25299

Nagios XI version xi-5.7.5 is affected by cross-site scripting XSS. The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session...

Cross site scripting

Nagios XI version xi-5.7.5 is affected by cross-site scripting XSS. The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session...

CVE-2021-25299

Nagios XI version xi-5.7.5 is affected by cross-site scripting XSS. The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session...

Nagios XI和Nagios 跨站脚本漏洞

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in /usr/local/nagiosxi/html/admin/sshterm.php in Nagios XI 5.7.5. The vulnerability stems...

Security Bulletin: IBM Security Verify Information Queue does not sufficiently protect its session cookies (CVE-2021-20404)

Summary IBM Security Verify Information Queue ISIQ does not sufficiently protect its session cookies from malicious modification. Consequently, a denial-of-service attack could cause ISIQ logins to fail with an invalid token. As of v10.0.0, ISIQ has strengthened the safeguards of session cookies...

U.S. Dept Of Defense: Reflected XSS in https://██████████ via "████████" parameter

Hello Security Team, I would like to report the XSS vulnerability on your system. The ██████████ parameter is not escaped properly for URL encoded values. ██████ Impact An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user...

IBM Security Identity Governance and Intelligence Information Disclosure Vulnerability

IBM Security Identity Governance and Intelligence is an integrated identity management solution based on network devices. An information disclosure vulnerability exists in IBM Security Identity Governance and Intelligence 5.2.6. The vulnerability stems from the product not setting security...

CVE-2020-4966

IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...

Authorization

IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...

CVE-2020-4966

CVE-2020-4966 affects IBM Security Identity Governance and Intelligence (IGI) 5.2.6, where authorization tokens and session cookies do not set the secure attribute. This may allow an attacker to obtain cookie values by users clicking a http:// link or visiting a page containing such a link, enabl...

Skyworth Gn542vf Information Disclosure Vulnerability

Skyworth Gn542vf is an Internet TV device from Skyworth, a Chinese company. A security vulnerability exists in Skyworth GN542VF Boa version 0.94.13, which can be exploited by an attacker to capture session cookies...

CVE-2020-4966

IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...

Mail.ru: CSRF + XSS leads to ATO

Reflected XSS on dwar.mail.ru via POST parameter formnick There was a Self-XSS issue on Request with no CSRF Protection leading to full Account Takeover due to Insecure Session Cookies...

CVE-2021-3113

Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...

CVE-2021-3113

Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...

CVE-2021-3113

Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...

CVE-2021-3113

Summary: CVE-2021-3113 affects Netsia SEBA+ up to version 0.16.1 build 70-e669dcd7. A direct request to /session/list/allActiveSession can disclose session cookies, potentially exposing an admin’s cookie and enabling admin access if an admin is logged in at the time of the request. Impact (as sta...

CVE-2021-3113

Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...