keycloak: session hijacking via re-authentication

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...

CVE-2024-0157

Dell Storage Resource Manager, 4.9.0.0 and below, contains a Session Fixation Vulnerability in SRM Windows Host Agent. An adjacent network unauthenticated attacker could potentially exploit this vulnerability, leading to the hijack of a targeted user's application session...

PT-2024-5633 · Dell · Dell Storage Resource Manager

Name of the Vulnerable Software and Affected Versions: Dell Storage Resource Manager version 4.9.0.0 and below Description: The issue is related to a session fixation problem in the SRM Windows Host Agent. An unauthenticated attacker on an adjacent network could exploit this, potentially leading ...

PT-2024-23114 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: ZITADEL versions prior to 2.42.17 ZITADEL versions 2.42.17 through 2.48.3 Description: ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it i...

PT-2024-22668 · Unknown · Easy-Popup-Show

Name of the Vulnerable Software and Affected Versions: easy-popup-show versions all Description: A cross-site request forgery CSRF issue allows a remote unauthenticated attacker to hijack the authentication of the administrator and perform unintended operations if the administrator views a...

CVE-2024-1304

Cross-site scripting vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows a remote attacker to send a specially crafted javascript payload to an authenticated user and partially hijack their browser session...

CVE-2024-1304

Cross-site scripting vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows a remote attacker to send a specially crafted javascript payload to an authenticated user and partially hijack their browser session...

Cross site scripting

CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to ...

Cross site scripting

Cross-site scripting vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows a remote attacker to send a specially crafted javascript payload to an authenticated user and partially hijack their browser session...

CVE-2024-1304 Multiple Vulnerabilities in Badger Meter's Monitool

Cross-site scripting vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows a remote attacker to send a specially crafted javascript payload to an authenticated user and partially hijack their browser session...

CVE-2024-1528 Cross-site Scripting in CMS Made Simple

CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to ...

s::can moni::tools Cross-Site Scripting Vulnerability

s::can moni::tools is a platform from s::can for managing a virtually unlimited number of sites, online probes, analyzers and parameters. A cross-site scripting vulnerability exists in s::can moni::tools version 4.6.3, which originates from a vulnerability that allows remote attackers to send a...

BIT-MOODLE-2021-40691

A session hijack risk was identified in the Shibboleth authentication plugin...

CVE-2024-24907

Dell Secure Connect Gateway SCG Policy Manager, all versions, contains a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a...

HelpDeskZ Cross-Site Scripting Vulnerability

HelpDeskZ is a free PHP-based software that allows you to manage your site's support using a web-based support ticket system. Provides quality support. A cross-site scripting vulnerability exists in HelpDeskZ 2.0.2 and prior versions, which stems from the presence of a cross-site scripting XSS...

PT-2024-20167 · Elecom · Elecom Wireless Lan Repeater +4

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers and wireless LAN repeater affected versions not specified Description: A cross-site request forgery CSRF issue allows a remote unauthenticated attacker to hijack the authentication of administrators and perform...

No fix KrbRelay VMware style

TL;DR The VMware Enhanced Authentication plugin that is offered as part of VMware vSphere’s seamless login experience for the web console contains multiple vulnerabilities relating to Kerberos authentication relay. The first vulnerability, CVE-2024-22245, is a Kerberos relay vulnerability where a...

VMware Alert: Uninstall EAP Now - Critical Flaw Puts Active Directory at Risk

VMware is urging users to uninstall the deprecated Enhanced Authentication Plugin EAP following the discovery of a critical security flaw. Tracked as CVE-2024-22245 CVSS score: 9.6, the vulnerability has been described as an arbitrary authentication relay bug. "A malicious actor could trick a...

PT-2024-2167 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: The issue is related to a flaw in the re-authentication mechanism within Keycloak, specifically in the org.keycloak.authentication module. This flaw allows an attacker to hijack an active...

Terminalfour Security Vulnerability

Terminalfour is a digital marketing and web content management platform for higher education from US-based Terminalfour, Inc. A security vulnerability exists in Terminalfour versions 7.4 through 7.4.0004 QP3, and 8 through 8.3.19, which stems from the possibility of unauthenticated stored...