PT-2023-21479

Name of the Vulnerable Software and Affected Versions HCL Verse affected versions not specified HCL BigFix Mobile affected versions not specified Description The issue allows a remote, unauthenticated attacker to execute script in a victim's web browser, potentially stealing sensitive information...

PT-2023-26384 · Unknown · Rws Worldserver

Name of the Vulnerable Software and Affected Versions: RWS WorldServer versions 11.7.3 and earlier Description: Session tokens in RWS WorldServer have a low entropy and can be enumerated, leading to unauthorized access to user sessions. Recommendations: For RWS WorldServer versions 11.7.3 and...

Statamic 4.7.0 - File-Inclusion

Title: Statamic 4.7.0 - File-Inclusion Author: nu11secur1ty Date: 07.13.2023 Vendor: https://statamic.com/ Software: https://demo.statamic.com/ Reference: https://portswigger.net/web-security/file-upload Description: The statamic-4.7.0 suffers from file inclusion - file upload vulnerability. The...

CVE-2022-36249

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...

Hospital Management System 授权问题漏洞

Hospital Management System HMS is a computerized system that helps manage healthcare-related information and helps healthcare providers do their jobs efficiently. A security vulnerability exists in PHP Gurukul Hospital Management System version v.4.0. A remote attacker can exploit the vulnerabili...

CVE-2023-1265

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

CVE-2023-1265

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

Design/Logic Flaw

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

UBUNTU-CVE-2023-1265

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

CVE-2023-1265

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

CVE-2023-1265

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

PT-2023-16848 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.9 through 15.9.6 GitLab versions 15.10 through 15.10.5 GitLab versions 15.11 through 15.11.1 Description: The issue allows a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab that originates from obtaining sessi...

CVE-2023-1265

Removed by vendor...

CVE-2023-1265

CVE-2023-1265 affects GitLab installations with the following vulnerable ranges: 11.9–15.9.6, 15.10–15.10.5, and 15.11–15.11.1. The issue enables a privileged attacker, under certain conditions, to obtain session tokens for all users on a GitLab instance. The provided documents do not specify the...

CVE-2023-1265

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

CVE-2023-1265: Session Fixation

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from...

Cross-site Scripting (XSS) in Admin Login too many attempts notice

Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user. Furthermore, JavaScript...

GHSA-FQ95-RX4Q-QGG2 Cross-site Scripting (XSS) in Admin Login too many attempts notice

Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user. Furthermore, JavaScript...

Insufficient Session Expiration

grumpydictator/firefly-iii is vulnerable to Insufficient Session Expiration. The vulnerability exists due to improper session configurations in session.php which allows an authenticated remote attacker to reuse session tokens because they do not expire after log out...