CVE-2022-38801: Improper Neutralization of Input During Web Page Generation

In Zkteco BioTime 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting...

Open-Xchange OX App Suite Cross-Site Script Vulnerability

Open-Xchange OX App Suite is an e-mail and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite version 7.10.6 and earlier, which originates from the fact that a contact that does not contain a name but only an email address ca...

CVE-2022-38801

In Zkteco BioTime 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting...

CVE-2022-38801

The CVE-2022-38801 entry affects Zkteco BioTime prior to 8.5.3 Build:20200816.447, where an employee can hijack an administrator session and cookies via blind cross-site scripting. The vulnerability is caused by a cross-site scripting flaw in BioTime, enabling session takeover and cookie access. ...

Open-Xchange OX App Suite Cross-Site Script Vulnerability

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite 7.10.6 and prior versions, which stems from a vulnerability that allows an attacker to use a special character that registers a...

Open-Xchange OX App Suite Cross-Site Script Vulnerability

Open-Xchange OX App Suite is an e-mail and productivity suite client software from the German company Open-Xchange. A security vulnerability exists in Open-Xchange OX App Suite version 7.10.6 and earlier, which stems from the fact that certain content such as E-Mail signatures are stored using a...

Open-Xchange OX App Suite Cross-Site Script Vulnerability

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite 7.10.6 and prior versions, which stems from a plain text email containing HTML code that can be used to inject script code when...

Ubuntu 16.04 ESM / 18.04 LTS : libICE vulnerability (USN-5744-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5744-1 advisory. It was discovered that libICE was using a weak mechanism to generate the session cookies. A local attacker could possibly use this issue to perform a...

CVE-2022-43398

A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50. Affected devices do not renew the session cookie after login/logout and also accept us...

Reflected Cross Site Scripting leading to session hijacking

Description Basic XSS: XSS Cross-Site Scripting vulnerabilities arise when untrusted data gets interpreted as code in a web context. XSS attacks effectively make the attacker logged in as the target user, with the nasty addition of tricking the user into giving some information such as their...

CVE-2021-46279

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0...

CVE-2021-46279

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0...

CVE-2021-46279: Session Fixation

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0...

Lanner IAC-AST2500A Authorization Issue Vulnerability

The Lanner IAC-AST2500A is a module and accelerator card from Lanner. It is suitable for Lanner network devices to support remote management and monitoring of system operation based on the IPMI standard. An authorization issue vulnerability exists in the Lanner IAC-AST2500A standard firmware...

PT-2022-12629 · Lanner · Iac-Ast2500A

Name of the Vulnerable Software and Affected Versions: Lanner Inc IAC-AST2500A version 1.10.0 Description: Session fixation and insufficient session expiration vulnerabilities allow an attacker to perform session hijacking attacks against users. Recommendations: For Lanner Inc IAC-AST2500A versio...

CVE-2021-46279 Session Fixation and Insufficient Session Expiration

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0...

CVE-2021-46279 Session Fixation and Insufficient Session Expiration

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0...

CVE-2022-3339: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to...

WiFi File Transfer 1.0.8 Cross Site Scripting

Document Title: =============== WiFi File Transfer v1.0.8 - Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2322 Release Date: ============= 2022-10-17 Vulnerability Laboratory ID VL-ID:...

WiFi File Transfer v1.0.8 - Cross Site Scripting Vulnerabilities

Document Title: =============== WiFi File Transfer v1.0.8 - Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2322 Release Date: ============= 2022-10-16 Vulnerability Laboratory ID VL-ID:...