CVE-2023-0897 Session FIxation in Sielco PolyEco1000

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

Sielco PolyEco FM Transmitter

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Sielco Equipment : PolyEco1000 Vulnerabilities : Session Fixation, Improper Restriction of Excessive Authentication Attempts, Improper Access Control 2. RISK...

Cross site scripting

Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Rack vulnerabilities (USN-5253-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5253-1 advisory. It was discovered that Rack insecurely handled session ids. An unauthenticated remote attacker could possibly use this issue to...

SAP BusinessObjects Business Intelligence Platform Authentication Bypass (3320702)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by an authentication bypass vulnerability. SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to ...

Exploit for Cross-site Scripting in Moosocial

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripti...

Cisco HyperFlex HX Data Platform 输入验证错误漏洞

The Cisco HyperFlex HX Data Platform is a high-performance, scalable distributed file system that supports a wide range of virtual machine monitoring programs and provides a range of enterprise-class data management and optimization services. An input validation error vulnerability exists in Cisc...

PT-2023-4782 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.7.0 Description: The issue is related to a session fixation vulnerability in the Airflow web interface, allowing an authenticated user to continue accessing the webserver even after their password has been...

Moodle Session Hijack Vulnerability (MSA-21-0032)

Moodle is prone to a Session Hijack risk vulnerability when Shibboleth authentication is enabled. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2023-37501

A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks...

CVE-2023-37499

A Persistent Cross-site Scripting XSS vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks...

CVE-2023-37499

A Persistent Cross-site Scripting XSS vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks...

CVE-2023-37499 A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform

A Persistent Cross-site Scripting XSS vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks...

PT-2023-25998 · Unknown · Unica Campaign

Name of the Vulnerable Software and Affected Versions: Unica Campaign affected versions not specified Description: A Persistent XSS issue can be exploited in a certain field, allowing an attacker to hijack a user's session and perform other attacks. Recommendations: At the moment, there is no...

Mitsubishi Electric GOT2000 Security Feature Issue Vulnerability

Mitsubishi Electric GOT2000 is a GOT2000 series graphical operator terminal from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric GOT2000. An unauthenticated remote attacker can hijack a data connection session hijacking or prevent a legitimate user from...

HCL Unica Platform Cross-Site Scripting Vulnerability

HCL Technologies HCL Unica Platform is a state-of-the-art enterprise automated marketing platform from HCL Technologies, USA. No manual effort is required to handle routine marketing tasks and capture the most effective leads. A security vulnerability exists in HCL Unica Platform versions prior t...

HCL Unica Campaign Cross-Site Scripting Vulnerability

HCL Technologies HCL Unica Campaign is a marketing campaign management solution from HCL Technologies. A security vulnerability exists in Unica Campaign versions prior to 12.1.3 that stems from the presence of a persistent cross-site scripting XSS vulnerability that allows an attacker to hijack a...

CVE-2023-26450

The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker...

CVE-2023-26447

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering...

PT-2023-20639 · Ox Software Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a widget that allows specifying a product description, which is taken from a user-controllable source and added to the DOM without...