576 matches found
CVE-2025-46840
Adobe Experience Manager (AEM) up to version 6.5.22 is affected by an Improper Authorization vulnerability (CVE-2025-46840). The issue could allow a low-privileged attacker to bypass security and escalate privileges, potentially enabling session takeover. Exploitation requires user interaction, a...
CVE-2025-46840 Adobe Experience Manager | Improper Authorization (CWE-285)
Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue...
CVE-2025-46837 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...
CVE-2025-46837 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...
CVE-2025-46837
Adobe Experience Manager (AEM) 6.5.22 and earlier are affected by a reflected Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which then execute in the victim’s browser and may lead to session takeover. The vulnerability ...
CVE-2025-42996
SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing...
PT-2025-24939 · Adobe · Experience Manager
Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: The issue is related to an Improper Authorization flaw that could result in Privilege escalation. A low-privileged attacker could leverage this to bypass security measures and...
PT-2025-24937 · Adobe · Experience Manager
Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: The issue is a reflected Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Wh...
Adobe Experience Manager 6.5.0 < 6.5.23 Multiple Vulnerabilities (APSB25-48)
The version of Adobe Experience Manager installed on the remote host is prior to 6.5.23. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-48 advisory. - Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability...
GHSA-H889-475R-WFMM Backend.AI Missing Authorization vulnerability
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI. NOTE: The maintainers of BackendAI do not consider this report to fit...
Backend.AI Missing Authorization vulnerability
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI. NOTE: The maintainers of BackendAI do not consider this report to fit...
CVE-2025-49651
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...
CVE-2025-49651 Missing Authorization for Interactive Sessions
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...
CVE-2025-49651
CVE-2025-49651 concerns Lablup BackendAI with Missing Authorization, enabling takeover of all active sessions and access/alteration of data within those sessions. The description indicates the vulnerability exists in all current BackendAI versions. Connected documents corroborate the issue but do...
CVE-2025-49651 Missing Authorization for Interactive Sessions
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...
PT-2025-24545
Name of the Vulnerable Software and Affected Versions Lablup's BackendAI affected versions not specified Description The issue is related to missing authorization in Lablup's BackendAI, allowing attackers to take over all active sessions. This enables them to access, steal, or alter any data...
CVE-2024-4026
Cross-Site Scripting XSS vulnerability in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within all editable parameters within the 'General' and 'Team ID' functionalities, which could result in a session takeover...
CVE-2024-6586
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to...
CVE-2024-28144
An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user...