CVE-2024-43009

CVE-2024-43009 is a reflected XSS in ZZCMS 2023 and earlier, where the HTTP_REFERER header value is inserted directly into the HTML response in user/login.php (line 24). This can allow an attacker to execute arbitrary JavaScript in a victim’s browser, potentially enabling session hijacking or def...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

CVE-2024-41475

CVE-2024-41475 affects Gnuboard g6 6.0.7. Vulnerable due to a misconfigured CORS policy that can enable session hijacking, potentially exposing user sessions (high/critical impact per sources). Remediation: fix CORS configuration to properly restrict cross-origin access; consider restricting acce...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

Gnuboard 安全漏洞

Gnuboard is a suite of extensible forum programs from the Gnuboard open source. A security vulnerability exists in Gnuboard g6 version 6.0.7, which stems from a CORS misconfiguration that makes it vulnerable to session hijacking...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

PT-2024-29416 · Gnuboard · Gnuboard

Name of the Vulnerable Software and Affected Versions: Gnuboard g6 version 6.0.7 Description: The issue is related to Session hijacking due to a CORS misconfiguration. This allows for unauthorized access to user sessions. Recommendations: For Gnuboard g6 version 6.0.7, update the CORS configurati...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to session hijacking due to Node.js passport module ( CVE-2022-25896 )

Summary Node.js passport module is used by IBM Cloud Pak for Data as part of the platform. CVE-2022-25896. Vulnerability Details CVEID:CVE-2022-25896 DESCRIPTION: Node.js passport module could allow a remote attacker to hijack a user's session, caused by a session fixation vulnerability. An...

CVE-2024-33990

Cross-Site Scripting XSS vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters ...

CVE-2023-26289

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Forc...

CVE-2023-26289

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Forc...

CVE-2023-26289

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection caused by improper validation of HOST headers. The issue affects IBM Aspera Orchestrator (server-side HTTP code) and can enable cross-site scripting, cache poisoning, or session hijacking, reported with CVSS ~5.4 (Network, Low c...

CVE-2023-26289 IBM Aspera Orchestrator HTTP header injection

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Forc...

CVE-2023-26289 IBM Aspera Orchestrator HTTP header injection

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Forc...

IBM Aspera Orchestrator 安全漏洞

IBM Aspera Orchestrator is a Web-based application from International Business Machines IBM, Inc. It can provide data-driven organizations with an efficient document processing pipeline. An HTTP header injection vulnerability exists in IBM Aspera Orchestrator version 4.0.1, which can be exploited...

Session Hijacking

craftcms/cms is vulnerable to Session Hijacking. The vulnerability is due to the reuse of TOTP tokens multiple times within the validity period, which allows an attacker with the victim's credentials to reuse a valid token and establish an authenticated session...

Craft CMS 安全漏洞

Craft CMS is Craft CMS open source content management system CMS. An access control error vulnerability exists in Craft CMS versions 5.0.0-beta.1 through 5.2.2, which stems from allowing multiple reuses of a TOTP token during its validity period. An attacker can exploit the vulnerability by...

Security Bulletin: IBM Aspera Orchestrator improved security for its HTTP code base (CVE-2023-26289)

Summary IBM Aspera Orchestrator has addressed a vulnerability related to handling of HTTP headers. Vulnerability Details CVEID:CVE-2023-26289 DESCRIPTION: IBM Aspera Orchestrator is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow a...

IBM Datacap Navigator HTTP Header Injection Vulnerability

IBM Datacap Navigator is a Web client for Datacap from International Business Machines IBM. IBM Datacap Navigator suffers from an HTTP header injection vulnerability that originates from an input validation error in the HOST header, which can be exploited by an attacker to conduct cross-site...