2108 matches found
PT-2022-24574 · Zkteco · Zkteco Biotime
Name of the Vulnerable Software and Affected Versions: Zkteco BioTime versions prior to 8.5.3 Build:20200816.447 Description: The issue allows an employee to hijack an administrator session and cookies using blind cross-site scripting. Recommendations: For versions prior to 8.5.3...
kernel: off-path attacker may inject data or terminate victim's TCP session
A TCP/IP packet spoofing attack flaw was found in the Linux kernel’s TCP/IP protocol, where a Man-in-the-Middle Attack MITM performs an IP fragmentation attack and an IPID collision. This flaw allows a remote user to pretend to be the sender of the TCP/IP packet for an existing TCP/IP session...
PT-2022-28226 · Unknown · Readthedocs
Name of the Vulnerable Software and Affected Versions: readthedocs versions prior to 8.8.1 Description: This issue allowed a malicious user to serve arbitrary HTML files from the main application domain by exploiting a vulnerability in the code that serves downloadable content from a project...
CVE-2022-43398
A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50. Affected devices do not renew the session cookie after login/logout and also accept us...
kernel: off-path attacker may inject data or terminate victim's TCP session
A TCP/IP packet spoofing attack flaw was found in the Linux kernel’s TCP/IP protocol, where a Man-in-the-Middle Attack MITM performs an IP fragmentation attack and an IPID collision. This flaw allows a remote user to pretend to be the sender of the TCP/IP packet for an existing TCP/IP session...
Citrix ADC and Citrix Gateway Session Hijack (CTX319135)
The remote Citrix ADC or Citrix Gateway device is version 12.1 before 12.1-62.25 or 13.0 before 13.0-82.42. It is therefore affected by a session hijack vulnerability that, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session. Please ref...
CVE-2022-3339
A reflected cross-site scripting XSS vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to...
SteaLinG - Open-Source Penetration Testing Framework Designed For Social Engineering
The SteaLinG is an open-source penetration testing framework designed for social engineering After the hack, you can upload it to the victim's device and run it disclaimers: This is only for testing purposes and can only be used where strict consent has been given. Do not use this for illegal...
Siemens SCALANCE X-200 and X-200IRT Families (Update A)
1. EXECUTIVE SUMMARY --------- Begin Update A part 1 of 2 --------- CVSS v3 9.6 --------- End Update A part 1 of 2 --------- ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SCALANCE X-200 and X-200IRT Families Vulnerability: Cross-site Scripting 2. UPDATE OR...
IBM Robotic Process Automation 安全漏洞
IBM Robotic Process Automation is a robotic process automation product from IBM U.S.A. A clickjacking vulnerability exists in IBM Robotic Process Automation, which can be exploited by remote attackers to submit special url requests that can be parsed by users to obtain sensitive information or...
Improper Authentication
moodle is using Improper Authentication. The vulnerability exists in logoutdbsession function in helper.php where a session hijack risk was identified in the shibboleth authentication plugin, in which the sessions weren't killed after the user logging out...
GHSA-92VH-MR2W-J2CR Moodle Improper Authentication
A session hijack risk was identified in the Shibboleth authentication plugin...
Moodle Improper Authentication
A session hijack risk was identified in the Shibboleth authentication plugin...
CVE-2021-40691
A session hijack risk was identified in the Shibboleth authentication plugin...
CVE-2021-40691
A session hijack risk was identified in the Shibboleth authentication plugin...
CVE-2021-40691
A session hijack risk was identified in the Shibboleth authentication plugin...
UBUNTU-CVE-2021-40691
A session hijack risk was identified in the Shibboleth authentication plugin...
Pimcore 跨站脚本漏洞
Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerability exists in...
CVE-2022-33927
Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...
Session fixation
Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...