6614 matches found
CVE-2023-29196 HTML injection via topic embedding in Discourse
Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in...
Information Disclosure
Spring Session Core is vulnerable to Information Disclosure. The vulnerability exists in the resolveSessionIds function in HeaderHttpSessionIdResolver.java because the session id is logged which allows an attacker with access to the application logs and perform session hijacking...
PT-2023-22195 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest tests-passed, beta and stable branches Description: This issue affects Discourse, an open source platform for community discussion. It is not exploitable on the default install of Discourse, requiring a...
Schneider Electric EcoStruxure Power Monitoring Expert 代码问题漏洞
The Schneider Electric EcoStruxure Power Monitoring Expert is a device from Schneider Electric France that is used to perform power distribution monitoring in IoT environments. The Schneider Electric EcoStruxure Power Monitoring Expert has a code issue vulnerability that stems from the presence o...
Discourse 跨站脚本漏洞
Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that originates from allowing embedding of Javascript via CSP, leading to user session hijacking. Affected product...
Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking
Exploit Title: Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking Exploit Author: LiquidWorm Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: 2.12 EXC5000GX 2.12 EXC120GX 2.11 EXC300GX 2.10 EXC1600GX 2.10 EXC2000GX 2.08 EXC1600GX 2.08...
GHSA-R7QR-F43M-PXFR Spring Session session ID can be logged to the standard output stream
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using...
Spring Session session ID can be logged to the standard output stream
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using...
CVE-2023-20866
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using...
CVE-2023-20866
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using...
Spoofing
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using...
CVE-2023-20866
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using...
CVE-2023-20866
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using...
CVE-2023-20866
CVE-2023-20866 affects Spring Session 3.0.0, where the session ID can be logged to standard output when using HeaderHttpSessionIdResolver. This leaks sensitive information from logs and can enable session hijacking. The NVD/CVSS data indicates a base score of 6.5 (MEDIUM) with high confidentialit...
Sielco Radio Link 2.06 Cookie Brute Force
Sielco Radio Link 2.06 'id' Cookie Brute Force Session Hijacking Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: 2.06 RTX19 2.05 RTX19 2.00 EXC19 1.60 RTX19 1.59 RTX19 1.55 EXC19 Summary: Sielco develops and produces radio links for all transmission and reception...
Sielco PolyEco Digital FM Transmitter 2.0.6 Cookie Brute Force
Sielco PolyEco Digital FM Transmitter 2.0.6 'polyeco' Session Hijacking Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: PolyEco1000 CPU:2.0.6 FPGA:10.19 PolyEco1000 CPU:1.9.4 FPGA:10.19 PolyEco1000 CPU:1.9.3 FPGA:10.19 PolyEco500 CPU:1.7.0 FPGA:10.16 PolyEco300...
Sielco Analog FM Transmitter 2.12 Cookie Brute Force
Sielco Analog FM Transmitter 2.12 'id' Cookie Brute Force Session Hijacking Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: 2.12 EXC5000GX 2.12 EXC120GX 2.11 EXC300GX 2.10 EXC1600GX 2.10 EXC2000GX 2.08 EXC1600GX 2.08 EXC1000GX 2.07 EXC3000GX 2.06 EXC5000GX 1.7.7...
Sielco Analog FM Transmitter 2.12 Cookie Brute Force Vulnerability
Sielco Analog FM Transmitter 2.12 'id' Cookie Brute Force Session Hijacking Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: 2.12 EXC5000GX 2.12 EXC120GX 2.11 EXC300GX 2.10 EXC1600GX 2.10 EXC2000GX 2.08 EXC1600GX 2.08 EXC1000GX 2.07 EXC3000GX 2.06 EXC5000GX 1.7.7...