GHSA-92PH-XM9V-CG3J Magento Broken authentication and session managememt

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate session validation setting for a storefront that leads to insecure authentication and session management...

The vulnerability of the update process for Cisco Unified Communications Manager (CM) and Cisco Unified Communications Manager Session Management Edition (SME) allows a perpetrator to write arbitrary files.

The vulnerability of the Cisco Unified Communications Manager CM and Cisco Unified Communications Manager Session Management Edition SME system updates lies in improper external management of file names or paths. Exploiting this vulnerability allows a malicious actor to write arbitrary files usin...

The vulnerability in the web interface of the Cisco Unified Communications Manager (CM), Cisco Unified Communications Manager Session Management Edition (SME), and the integrated messaging system Cisco Unity Connection allows a perpetrator to perform cross-site scripting attacks.

The vulnerability of the Web interface for managing Cisco Unified Communications Manager CM, Cisco Unified Communications Manager Session Management Edition SME, and the integrated messaging system Cisco Unity Connection is related to the lack of security measures taken to protect the web page...

GHSA-J97Q-9XP9-G5FX Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint

An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting XSS attack is possible in the clientId parameter of a request...

Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint

An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting XSS attack is possible in the clientId parameter of a request...

The vulnerability of the Cisco Discovery Protocol implementation in Cisco Unified Communications Manager (CM) and Cisco Unified Communications Manager Session Management Edition (SME) systems allows a attacker to cause service interruptions.

The vulnerability of the Cisco Discovery Protocol implementation in Cisco Unified Communications Manager CM and Cisco Unified Communications Manager Session Management Edition SME systems is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could all...

PT-2022-7195 · Ultraloq · Ultraloq Ul3 2Nd Gen Smart Lock

Name of the Vulnerable Software and Affected Versions: Ultraloq UL3 2nd Gen Smart Lock Firmware version 02.27.0012 Description: The issue is related to incorrect session management and credential re-use in the Bluetooth LE stack, allowing an attacker to sniff the unlock code and unlock the device...

Plone Improper Session Management

Plone CMS before 3, places a base64 encoded form of the username and password in the ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network...

GHSA-593C-J348-F3GV Plone Improper Session Management

Plone CMS before 3, places a base64 encoded form of the username and password in the ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network...

GHSA-MQ3Q-JJPH-RP5P Plone CMS Improper Session Management

Plone CMS before 3 places a base64 encoded form of the username and password in the ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network...

Plone CMS Improper Session Management

Plone CMS before 3 places a base64 encoded form of the username and password in the ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network...

Cisco Unified CM and Unified CM SME Arbitrary File Read Vulnerability

Cisco Unified Communications Manager is a call processing component of Cisco's Unified Communications System. Unified Communications Manager Session Management Edition is the session management version of Unified Communications Manager. An arbitrary file read vulnerability exists in Unified CM an...

Cisco Unified CM and Unified CM SME Cross-Site Request Forgery Vulnerability

Cisco Unified Communications Manager is a call processing component of the Unified Communications System from Cisco, USA. Unified Communications Manager Session Management Edition is the session management version of Unified Communications Manager. A cross-site request forgery vulnerability exist...

Cisco Unified CM and Unified CM SME Arbitrary File Writing Vulnerability

Cisco Unified Communications Manager is a call processing component of Cisco's Unified Communications System. Unified Communications Manager Session Management Edition is the session management version of Unified Communications Manager. cisco Unified CM and Unified CM SME are vulnerable to an...

CVE-2022-20790

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system...

CVE-2022-20787

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM Software and Cisco Unified CM Session Management Edition SME Software could allow an authenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected device...

CVE-2022-20787 Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM Software and Cisco Unified CM Session Management Edition SME Software could allow an authenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected device...

CVE-2022-20787

CVE-2022-20787 affects the web-based management interfaces of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The root cause is insufficient CSRF protections, allowing an authenticated, remote attacker to entice a user to click a malicious link a...

CVE-2022-20804

A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, adjacent attacker to cause a kernel panic on an affected system, resulting in a...

Cisco Unified Communications Manager 代码问题漏洞

Cisco Unified Communications Manager is a call processing component of Cisco's Unified Communications System. The component provides a scalable, distributable, and highly available call processing solution for enterprise IP telephony. Unified Communications Manager Session Management Edition is t...