939 matches found
CVE-2018-1962
IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658...
Cross-Site Scripting (XSS)
public is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitary Javascript into a victim's browser through the filePath parameter to steal session tokens or perform unwanted actions on behalf of the user...
Cross-Site Scripting (XSS)
croogo/croogo is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim’s browser via the title parameter in the Attachment page to steal session tokens or perform unwanted actions on behalf of the user...
Cross-Site Scripting (XSS)
croogo/croogo is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the title parameter in the Vocabulary page to steal session tokens or perform unwanted actions on behalf of the user...
Cross-Site Scripting (XSS)
com.liferay.expando.web is vulnerable to cross-site scripting. The modelResource parameter is not HTML encoded before being displayed on a user's browser, which allows remote attackers to inject arbitrary Javascript into the victim's browser to steal session tokens or perform unwanted actions on...
CVE-2018-19718
Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead to exposure of the privileges granted to a session...
Cross-Site Scripting (XSS)
bootstrap-vue is vulnerable to cross-site scripting XSS. The option variable is not validated and sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...
Replay Attack
tendrl-api is vulnerable to replay attack. The server does not invalidate session tokens immediately when a user logs out of the application. This allows an attacker, who has obtained a user's session tokens via sniffing/MitM attack, to re-use or replay a user's session token or request to gain...
Cross-site Scripting (XSS)
pki-tps is vulnerable to cross-site scripting. A lack of input validation and sanitization allows a remote attacker to inject arbitrary Javascript into a victim's browser via the PATHINFO variable to steal session tokens or perform unwanted actions on behalf of the user...
Cross-site Scripting (XSS)
php-pecl-apc is vulnerable to cross-site scripting. The apc.php script does not perform validation and sanitization on its user input, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the us...
The vulnerability of the Cisco HyperFlex hyper-converged infrastructure, related to the insecure external control of critical data states, allows attackers to create valid signed tokens for sessions and increase their privileges.
The vulnerability of the Cisco HyperFlex hyper-converged infrastructure is related to the insecure external control of critical data states. Exploiting this vulnerability allows a malicious actor to create valid signed tokens for sessions and enhance their privileges...
Cross-Site Scripting (XSS)
angular.js is vulnerable to cross-site scripting XSS. The server-side templating engine is not able to escape AngularJS interpolation symbols and does not escape meaningful symbols in strings, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal...
Cross-Site Scripting (XSS)
Bootstrap is vulnerable to cross-site scripting XSS. An attacker is able to inject arbitrary Javascript into a victim's browser via the tooltip data-viewport attribute, to steal session tokens or perform unwanted actions on behalf of the user...
Cross-Site Scripting (XSS)
dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The datatoexport parameter in /exports/export.php is not properly sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the...
Cross-Site Scripting (XSS)
craftcms/cms is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user via the title parameter...
Cross-Site Scripting (XSS)
github.com/go-gitea/gitea is vulnerable to cross-site scripting XSS. The avatar URL is not HTML encoded when initCommentForm creates its elements. This allows a remote attacker to inject arbitrary Javascript into a victim's browser using a malformed avatar URL to steal session tokens or perform...
Cross-Site Scripting (XSS)
easymon is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the check name parameter to steal session tokens or perform unwanted actions on behalf of the user...
Cross-Site Scripting (XSS)
intelliants/subrion CMS is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the Site Title parameter in panel/configuration/general, to steal session tokens or perform unwanted action on behalf of the user...
Cross-Site Scripting (XSS)
dnn.platform is vulnerable to cross-site scripting. The return URL is not sanitized which allows for remote attackers to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...
