BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password) Vulnerability

Exploit for hardware platform in category web applications Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery Change Password Exploit Author: William Summerhill Vendor Homepage:bhttps://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE: CVE-2020-1494...

CVE-2020-4044

The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This wi...

Cross site request forgery (csrf)

An issue was discovered in Navigate CMS 2.9 r1433. Sessions, as well as associated information such as CSRF tokens, are stored in cleartext files in the directory /private/sessions. An unauthenticated user could use a brute-force approach to attempt to identify existing sessions, or view the...

Perfex v2.4.4 CRM - (Print) Persistent Web Vulnerability

Document Title: =============== Perfex v2.4.4 CRM - Print Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2231 Release Date: ============= 2020-06-23 Vulnerability Laboratory ID VL-ID: ==================================== 22...

CVE-2020-6644

An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

rubygem-rack: hijack sessions by using timing attacks targeting the session id

A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality...

CVE-2020-13229

An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token...

Authentication flaw

An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token...

CVE-2020-13229

An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token...

CVE-2020-13229

Sysax Multi Server 6.90 is affected by CVE-2020-13229, where an attacker can hijack a session by observing the sid authentication token in any /scgi URI. The vulnerability directly exposes session confidentiality and integrity, as the sid value acts as an authentication token. NVD reports CVSS v3...

Insecure Password Update

com.liferay.login.web is vulnerable to insecure password update. During the user password update, it is allowed to update the password via JSONWS without supplying their current password, leading to other attacks such as XSS, session hijacking, an unattended workstation or other vectors...

OhMyQR - Hijack Services That Relies On QR Code Authentication

QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which...

Palo Alto Networks PAN-OS Cross-Site Scripting Vulnerability (CNVD-2020-32243)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A cross-site scripting vulnerability exists in Palo Alto Networks PAN-OS, which can be exploited by an attacker to hijack a user's active session when the user accesses a malicious websit...

CVE-2020-2005 PAN-OS: GlobalProtect Clientless VPN session hijacking

A cross-site scripting XSS vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0...

PAN-OS: GlobalProtect Clientless VPN session hijacking

A cross-site scripting XSS vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0...

Tryton 5.4 - Persistent Cross-Site Scripting

Exploit Title: Tryton 5.4 - Persistent Cross-Site Scripting Exploit Author: Vulnerability-Lab Date: 2020-05-13 Vendor Homepage: https://www.tryton.org/ Version: 5.4 Software Link: https://www.tryton.org/download Document Title: =============== Tryton v5.4 - Name Persistent Cross Site Vulnerabilit...

Tryton 5.4 Cross Site Scripting

Document Title: =============== Tryton v5.4 - Name Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2233 Release Date: ============= 2020-05-12 Vulnerability Laboratory ID VL-ID: ==================================== 22...

Tryton 5.4 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Tryton 5.4 - Persistent Cross-Site Scripting Vendor Homepage: https://www.tryton.org/ Version: 5.4 Software Link: https://www.tryton.org/download Document Title: =============== Tryton v5.4 - Name Persistent Cross Site...

Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting Exploit Author: gurbanli Vendor Homepage: https://www.sellacious.com Version: 4.6 Software Link: https://www.sellacious.com/free-open-source-ecommerce-software Document...

Sellacious eCommerce Shop Cross Site Scripting

Document Title: =============== Sellacious eCommerce - Multiple Persistent Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2226 Release Date: ============= 2020-05-08 Vulnerability Laboratory ID VL-ID: ===================================...