CVE-2022-27888

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information session tokens. This issue was fixed in 2.249.1...

CVE-2021-41542

A vulnerability has been identified in Climatix POL909 AWB module All versions V11.44, Climatix POL909 AWM module All versions V11.36. The User Management page of affected devices is vulnerable to cross-site scripting XSS. The vulnerability allows an attacker to send malicious JavaScript code whi...

CVE-2021-41541

A vulnerability has been identified in Climatix POL909 AWB module All versions V11.44, Climatix POL909 AWM module All versions V11.36. The Group Management page of affected devices is vulnerable to cross-site scripting XSS. The vulnerability allows an attacker to send malicious JavaScript code...

Cross site scripting

A vulnerability has been identified in Climatix POL909 AWB module All versions V11.44, Climatix POL909 AWM module All versions V11.36. The User Management page of affected devices is vulnerable to cross-site scripting XSS. The vulnerability allows an attacker to send malicious JavaScript code whi...

Mattermost Boards Plugin Trust Management Issue Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. The Mattermost Boards plugin in v0.10.0 and prior versions is vulnerable to a trust management issue that stems from the lack of an effective trust management mechanism in the network system or product. An attacker could...

Mattermost 代码问题漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. The Mattermost Boards plugin in v0.10.0 and prior versions is vulnerable to a trust management issue that stems from the lack of an effective trust management mechanism in the network system or product. An attacker could...

PT-2021-4989 · Mcafee · Mcafee Policy Auditor

Name of the Vulnerable Software and Affected Versions: McAfee Policy Auditor versions prior to 6.5.2 Description: The issue is related to a Reflected Cross-Site Scripting vulnerability in the web interface of McAfee Policy Auditor. This vulnerability allows a remote unauthenticated attacker to...

Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja

Description In recent InvoiceNinja version 9d7145c in /documents it is possible to store svg file with html/js content, which later can be used to phish other users Proof of Concept POST /documents HTTP/1.1 Host: 172.17.0.1:8888 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:95.0 Gecko/20100101...

CVE-2021-43046

The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability...

CVE-2021-43046

The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability...

Code injection

The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability...

CVE-2021-43046

The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability...

PT-2021-23734

Name of the Vulnerable Software and Affected Versions TIBCO PartnerExpress versions 6.2.1 and below Description The vulnerability in TIBCO PartnerExpress allows an unauthenticated attacker with network access to obtain session tokens for the affected system. This can be achieved through an easily...

CVE-2021-42703

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

CVE-2021-42703

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

eLabFTW 安全漏洞

Elabftw is an open source platform for hosting experimental data. The platform runs on Linux and supports storing a wide range of objects. A security vulnerability exists in eLabFTW, which originated in versions of eLabFTW prior to 4.1.0, that allows an attacker to bypass the brute-force protecti...

Cross-site Scripting (XSS) - Stored in msaari/relevanssi

Description Good afternoon. Beginning on 12 October 2021, our XSS catcher started receiving callbacks from a group of sites that are using the Relevanssi plugin for Wordpress. It appears to us that the software is not properly filtering Unsuccessful searches before displaying the information to t...

Cross-site Scripting (XSS) - Reflected in yeswiki/yeswiki

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execut...

Cross-site Scripting (XSS) - Reflected in part-db/part-db

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execut...

GHSA-7PR3-P5FM-8R9X LiveQuery publishes user session tokens in parse-server

Impact For regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery...