2404 matches found
CVE-2019-14826: Insufficient Session Expiration
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session...
Exploit for Path Traversal in Ivanti Connect_Secure
pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitr...
PT-2019-5369
Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.5.0 and later Description The issue is related to incorrect session expiration. An attacker could exploit this to gain access to a session if they obtain previously valid session cookies. Recommendations For FreeIPA versions...
Node.js third-party modules: [node-red] Stored XSS within Flow's - "Name" field
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report Stored XSS in...
CVE-2018-17213
CVE-2018-17213 affects PrinterOn Central Print Services (CPS) up to version 4.1.4. The issue allows a user without valid credentials to bypass authentication and obtain a valid session cookie with guest/pseudo-guest privileges, which can then be used to perform other attacks. The Red Hat and NVD ...
Ahsay Backup 8.1.1.50 - Insecure File Upload and Code Execution (Authenticated)
Exploit Title: Ahsay Backup 8.1.1.50 - Insecure File Upload and Code Execution Authenticated Date: 26-6-2019 Exploit Author: Wietse Boonstra Vendor Homepage: https://ahsay.com Software Link: http://ahsay-dn.ahsay.com/v8/81150/cbs-win.exe Version: 7.x 8.1.1.50 Tested on: Windows / Linux CVE :...
CVE-2019-1010207
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting XSS. The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/he...
CVE-2019-1010207
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting XSS. The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/he...
Cross site scripting
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting XSS. The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/he...
CVE-2019-1010207
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting XSS. The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/he...
CVE-2019-1010207
Genetechsolutions Pie Register 3.0.15 is affected by Cross Site Scripting (XSS) in the Login component (parameters: interim-login, wp-lang, and supplied URL). The issue allows an attacker to steal session cookies if a user clicks a malicious link; root cause is insufficient validation of client-s...
PT-2019-11512
Name of the Vulnerable Software and Affected Versions: Genetechsolutions Pie Register version 3.0.15 Description: The issue allows for Cross Site Scripting XSS, which can lead to the stealing of session cookies. The vulnerable component is the Login file, specifically the parameters interim-login...
CVE-2018-17210
An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass...
U.S. Dept Of Defense: [██████] Reflected GET XSS (/personnel.php?..&folder=*) with mouse action
I will combine this vulnerability with this vulnerability described in this report 648222. If you have not read this report, I recommend reading that report first, and then studying this report. I want to note that this report cannot be closed as a duplicate to the above described report. why?...
CVE-2019-7215
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions...
CVE-2019-7215
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions...
CVE-2019-7215
Progress Sitefinity 10.1.6536 does not invalidate session cookies on logout; the browser cookie is overwritten but remains valid on the server, allowing reuse of an active session to access the account even after credentials/permissions change. This is confirmed across multiple sources (NVD, Red ...
PT-2019-18467
Name of the Vulnerable Software and Affected Versions Progress Sitefinity version 10.1.6536 Description The issue allows session cookies to remain valid on the server side after a user logs out, as the system attempts to overwrite the cookie in the browser instead of invalidating it. This enables...
CVE-2019-7215: Insufficient Session Expiration
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions...