2026 matches found
Cisco Firepower Management Center 安全漏洞
Cisco Firepower Management Center is a new generation of firewall management center software from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Firepower Management Center WEB interface, which can be exploited by a remote attacker to inject malicious scrip...
Session Fixation
org.keycloak:keycloak-services is vulnerable to Session Fixation. The vulnerability is due to the session ID and JSESSIONID cookie not being changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured, allowing an attacker to hijack the session before authentication...
PT-2024-33479 · Ibm · Ibm Watson Studio Local
Name of the Vulnerable Software and Affected Versions: IBM Watson Studio Local version 1.2.3 Description: The issue is related to a cross-site request forgery vulnerability, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
SAP NetWeaver Enterprise Portal 跨站脚本漏洞
Backoffice for SAP Commerce Cloud is a user-centered, scalable back-end interface that allows business users to easily manage any type of data in SAP Commerce Cloud. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which can be exploited by remote attackers to injec...
Citrix Workspace app for Mac Security Bulletin for CVE-2024-7549
Description of Problem A vulnerability has been discovered in Citrix Workspace app for Mac, which, if exploited, may result in a session hijack of a user who is authenticated on cloud stores. Affected Versions: The following supported versions of Citrix Workspace app for Mac are affected by the...
CVE-2024-20509
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service DoS condition for individual users of the AnyConnect VPN...
PT-2025-2094 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.8.0 Description: The issue is related to incorrect session management in the Two-factor Authentication TFA module of the Drupal CMS system. This can allow a remote attacker to hija...
PT-2025-2098 · Drupal · Drupal Facets
Name of the Vulnerable Software and Affected Versions: Drupal Facets versions 0.0.0 through 2.0.9 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can be exploited by a remote attacker to hijack a user's...
Cisco AnyConnect VPN 竞争条件问题漏洞
Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a Competitive Condition Issue vulnerability that stems from a weak entropy value of the handler used in...
GHSA-VVF8-2H68-9475 Duplicate Advisory: Keycloak Open Redirect vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w8gr-xwp4-r9f7. This link is maintained to preserve external references. Original Description A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL...
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...
PT-2024-39298 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A misconfiguration flaw was found in Keycloak, allowing an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1. This...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the contact tracking and page hits report feature. An attacker can manipulate web content or hijack user sessions by injecting malicious scripts. Details Cross-site scripting or XSS is a code vulnerabili...
PT-2024-6491 · Advantech · Adam-5630
Name of the Vulnerable Software and Affected Versions: Advantech ADAM-5630 affected versions not specified Description: The issue is related to a cross-site request forgery CSRF vulnerability, which allows an attacker to partly circumvent the same origin policy. This policy is designed to prevent...
CVE-2024-7341
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...
CVE-2024-8413
Cross Site Scripting XSS vulnerability through the action parameter in index.php. Affected product codebase https://github.com/Bioshox/Raspcontrol and forks such as https://github.com/harmon25/raspcontrol . An attacker could exploit this vulnerability by sending a specially crafted JavaScript...
PT-2024-38995 · Bioshox · Raspcontrol
Name of the Vulnerable Software and Affected Versions: Raspcontrol version 1.0 Description: A Cross Site Scripting XSS issue exists through the action parameter in index.php. This allows an attacker to send a specially crafted JavaScript payload to an authenticated user, potentially hijacking the...
ZZCMS 安全漏洞
ZZCMS is a content management system by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS caina.php handling HTTPReferer, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack us...