CVE-2021-4201 Pre-authentication session hijacking

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior...

CVE-2021-4201

CVE-2021-4201 describes a missing access control in ForgeRock Access Management, affecting 7.1.x before 7.1.1 and 6.5.x before 6.5.4, plus all earlier versions. The issue allows remote unauthenticated attackers to hijack sessions, potentially including admin-level sessions. Connected sources corr...

ForgeRock Access Management授权问题漏洞

Forgerock ForgeRock Access Management is a comprehensive, unified solution from ForgeRock USA Forgerock designed to quickly enable a superior experience tailored to the unique needs of users and employees. A security vulnerability exists in ForgeRock Access Management 7.1.0, which stems from a la...

CVE-2021-39066

IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040...

CVE-2021-39066

IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040...

多款Schneider Electric产品代码问题漏洞

Schneider Electric EVlink City and others are a charging solution for electric vehicle charging stations from Schneider Electric, a French company. A security vulnerability exists in several Schneider Electric products that allows an attacker to gain unauthorized access to the charging station we...

Ametys CMS 4.4.1 Cross Site Scripting Vulnerability

Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability Product & Service Introduction: =============================== Build powerful and stunning websites. Whether you need an advanced corporate website, a powerful landing page, a professionnal blog or an event...

Ametys CMS 4.4.1 Cross Site Scripting

Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2275 Release Date: ============= 2022-01-12 Vulnerability Laboratory ID VL-ID: ==================================== 22...

CVE-2022-22551

DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...

CVE-2022-22551

DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...

IBM Cloud Pak for Automation Input Validation Error Vulnerability

IBM Cloud Pak for Automation is an intelligent software platform for building automation applications in cloud environments from IBM USA. The platform uses pre-integrated automation technologies and low-code tools to design, build and run automation applications and services on any cloud. A...

uBidAuction v2.0.1 - Multiple XSS Web Vulnerabilities

Document Title: =============== uBidAuction v2.0.1 - Multiple XSS Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2289 Release Date: ============= 2022-01-21 Vulnerability Laboratory ID VL-ID: ==================================== 228...

Rocket LMS 1.1 - Persistent Cross Site Scripting Vulnerability

Exploit Title: Rocket LMS 1.1 - Persistent Cross Site Scripting XSS Document Title: =============== Rocket LMS 1.1 - Persistent Cross Site Scripting XSS Product & Service Introduction: =============================== Rocket LMS is an online course marketplace with a pile of features that helps yo...

Affiliate Pro 1.7 - (Multiple) Cross Site Scripting Vulnerability

Exploit Title: Affiliate Pro 1.7 - 'Multiple' Cross Site Scripting XSS Document Title: =============== Affiliate Pro v1.7 - Multiple Cross Site Vulnerabilities Product & Service Introduction: =============================== Affiliate Pro is a Powerful and yet simple to use PHP affiliate Managemen...

CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP...

CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP...

CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP...

IBM Cloud Pak for Automation 安全漏洞

IBM Cloud Pak for Automation is an intelligent software platform for building automation applications in cloud environments from IBM USA. The platform uses pre-integrated automation technologies and low-code tools to design, build and run automation applications and services on any cloud. A...

DEBIAN-CVE-2022-23133

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can...

CVE-2022-23133

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can...