CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

NovelSat NS3000和NovelSat NS2000 安全漏洞

The NovelSat NS3000 and NovelSat NS2000 are both satellite modems from NovelSat, an Israeli company. A security vulnerability exists in NovelSat NS3000 and NovelSat NS2000 that stems from a lack of authentication checks and could lead to session hijacking. The following products and versions are...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

CVE-2025-45814: Missing Authentication for Critical Function

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

Cisco Meraki 16.2 / 17 / 18.1 < 18.107.13 / 18.2 < 18.211.3 DoS (cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X)

The version of the remote Cisco Meraki device is 16.2, 17, 18.1 prior to 18.107.13, or 18.2 prior to 18.211.3. It is, therefore, potentially affected by a denial of service vulnerability as referenced in the cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X advisory: - A vulnerability in the Cisco AnyConnec...

CVE-2025-45814

The NovelSat NS3000 and NovelSat NS2000 satellite demodulators are vulnerable to a security flaw due to missing authentication checks for critical functions. Specifically, the query.fcgi endpoint in NS3000 versions v8.1.1.125110 , v7.2.8.124852 , and v7.x , as well as NS2000 version v7.02.08 , la...

PT-2025-27663

Name of the Vulnerable Software and Affected Versions: NS3000 versions 7.x through 8.1.1.125110 NS2000 version 7.02.08 Description: The issue is related to missing authentication checks in the "query.fcgi" endpoint, which allows attackers to execute a session hijacking attack. Recommendations: Fo...

CVE-2025-52553

authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, howev...

CVE-2025-52553

CVE-2025-52553 affects authentik (open-source identity provider). The vulnerability arises from a session-specific, single-use token generated after authorizing access to a RAC endpoint that is embedded in the URL; the check ensuring the token is valid only for the originating user’s session is m...

CVE-2025-52553

authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, howev...

CVE-2025-52553: Improper Authentication

authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, howev...

PT-2025-27232

Name of the Vulnerable Software and Affected Versions: authentik versions prior to 2025.4.3 authentik versions prior to 2025.6.3 Description: The issue arises from the way authentik handles tokens after authorizing access to a RAC endpoint. A token is created for a single connection and sent to t...

CVE-2025-48463

Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...

CVE-2025-48470

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...

PT-2025-26852 · C3Crm · C3Crm

Name of the Vulnerable Software and Affected Versions: c3crm versions up to 3.0.4 Description: A cross-site scripting XSS issue in the /Login.php component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login error parameter. This enables attacke...

Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the...

CVE-2025-48470

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...

CVE-2025-48463

Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...