2894 matches found
Design/Logic Flaw
An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. The ASP.NETSessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels...
Cherwell Service Management 信息泄露漏洞
Cherwell Service Management is flexible, feature-rich ITSM software that is easy to use, configure, and maintain. An information disclosure vulnerability exists in Cherwell Service Management that stems from the product not effectively protecting the ASP.NETSessionid cookie. The vulnerability can...
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Synacor Zimbra Collaboration Suite ZCS contains a cross-site scripting XSS vulnerability in the Calendar feature that allows an attacker to execute arbitrary code...
Cross site request forgery (csrf)
DISPUTED A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a...
CVE-2021-45268
A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...
Type confusion
The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...
CVE-2021-24814 WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting
The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...
Exposure of Sensitive Information in simple-get
In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party...
WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting
The checkprivacysettings AJAX action of the plugin, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript...
Cross-site Scripting (XSS)
pimcore/pimcore is vulnerable to cross-site scripting. The storetreeAction function in ClassificationstoreController.php does not properly escape the user input name field, allowing an attacker to access the user's session cookie through the input payload...
Cross-site Scripting (XSS) - Generic in projectsend/projectsend
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...
in zikula/core
Description When sending test emails, you're able to spam a target email address with as many emails as an attacker wants to a victim's email address due to lack of rate limiting /mailer/config/test I've put together a simple Python script that exploits this and would allow you to send a custom...
GitLab: Gitlab Pages token theft using service workers
Summary It is possible to steal Gitlab Pages session tokens by intercepting requests to the /auth endpoint on a Pages site using service workers. Attack Flow Setup 1. The attacker creates a private Gitlab Pages site at the root of their user page attacker.gitlab.io, ensuring that the project is...
DamiCMS Cross-site Request Forgery Vulnerability (CNVD-2022-02728)
A security vulnerability exists in DamiCMS v6.0, which originates from the lack of cookie protection in /damicms-master/admin.php?s=/Article/doedit, and could be exploited to compromise and impersonate a user's account by obtaining their session cookie. session cookie to compromise and impersonat...
CVE-2020-21236
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie...
Design/Logic Flaw
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie...
CVE-2020-21236
The CVE-2020-21236 entry affects DamiCMS v6.0, specifically /damicms-master/admin.php?s=/Article/doedit. The root cause is lack of cookie protection, enabling an attacker to obtain a user’s session cookie and impersonate that user. Several connected sources (CVE lists, Red Hat advisory, CNVD) cor...
PT-2021-10604
Name of the Vulnerable Software and Affected Versions: DamiCMS version 6.0 Description: A vulnerability in the "/damicms-master/admin.php?s=/Article/doedit" endpoint of DamiCMS allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie. Recommendations: For...
DamiCMS跨站请求伪造漏洞
A security vulnerability exists in DamiCMS v6.0, which originates from the lack of cookie protection in /damicms-master/admin.php?s=/Article/doedit, and could be exploited to compromise and impersonate a user's account by obtaining their session cookie. session cookie to compromise and impersonat...
CVE-2020-21236: Cross-Site Request Forgery (CSRF)
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie...