CVE-2023-40732

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...

CVE-2023-40732

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...

CVE-2023-40732

CVE-2023-40732 affects Siemens QMS Automotive: the QMS.Mobile module does not invalidate the session token on logout for all versions before V12.39, enabling potential session hijacking. Impact is limited to user sessions; CVSS v3.1 base score 3.9 (LOW). Remediation per sources: update to V12.39 ...

Siemens QMS Automotive 代码问题漏洞

Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. A code issue vulnerability exists in Siemens QMS Automotive, which stems from the affected application's QMS.Mobile module not invalidating session tokens upon logout. An attacker could exploi...

PT-2023-5189 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the QMS.Mobile module of the QMS Automotive software, which does not properly invalidate session tokens upon logout. This could allow an attacker to perform session...

Cisco HyperFlex HX Data Platform Input Validation Error Vulnerability

The Cisco HyperFlex HX Data Platform is a high-performance, scalable distributed file system that supports a wide range of virtual machine monitoring programs and provides a range of enterprise-class data management and optimization services. An input validation error vulnerability exists in Cisc...

Code injection

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user...

CVE-2023-39423 Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user...

ROS-20230905-02

Vulnerability in the ksmbd module of Linux kernel operating systems is related to synchronization errors when using a shared resource. synchronization errors when using a shared resource. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code using the...

The Hidden Dangers of Public Wi-Fi

Public Wi-Fi, which has long since become the norm, poses threats to not only individual users but also businesses. With the rise of remote work, people can now work from virtually anywhere: a cafe close to home, a hotel in a different city, or even while waiting for a plane at the airport. Next,...

Cross site scripting

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...

PT-2023-19661 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to v767 Description: The issue is related to a Cross-site Scripting XSS vulnerability in the Visual Console Module of Pandora FMS. This vulnerability could be used to hijack admin users' session cookie values and...

CVE-2023-40024 Reflected Cross-Site Scripting (XSS) in scancode.io license endpoint

ScanCode.io is a server to script and automate software composition analysis pipelines. In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting XSS vulnerability when attempting to access a detailed license vie...

PT-2023-5949

Name of the Vulnerable Software and Affected Versions ScanCode.io versions prior to 32.5.2 Description The issue arises from inadequate validation and sanitization of the key parameter in the /license/ endpoint, specifically in the license details view function. This can result in a potential...

Default credentials

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully steali...

CVE-2023-39963

CVE-2023-39963 affects Nextcloud Server: a missing password confirmation after stealing a session can allow an attacker to create app passwords for the victim in listed older branches (versions before patches 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8/9, 24.0.12.5, 25.0.9, 26.0.4, 27.0.1; patch...

PHPJabbers Vacation Rental Script 4.0 - CSRF

Exploit Title: PHPJabbers Vacation Rental Script 4.0 - CSRF Date: 05/08/2023 Exploit Author: Hasan Ali YILDIR Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/vacation-rental-script/ Version: 4.0 Tested on: Windows 10 Pro Description The attacker can send to...

CrushFTP Unauthenticated RCE

This exploit module leverages an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability CVE-2023-43177 to achieve unauthenticated remote code execution. This affects CrushFTP versions prior to 10.5.1. It is possible to set some user's session properties by...

CVE-2023-3373

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections session hijacking ...

CVE-2023-3373

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections session hijacking ...