CVE-2021-29676

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site...

CVE-2021-32710

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older version...

CVE-2021-32710

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older version...

CVE-2021-32710

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older version...

Code injection

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older version...

CVE-2021-32710 Potential Session Hijacking in Shopware

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older version...

CVE-2021-32710

CVE-2021-32710 affects Shopware (open source eCommerce platform) for versions below 6.3.5.2. The issue is described as potential session hijacking of store customers due to insecure session handling, with remediation guidance to update to version 6.3.5.2 (via Auto-Updater or download). For older ...

Ice Hrm Session Fixation Vulnerability

Ice Hrm is a human resource management system. Ice Hrm suffers from a session fixation vulnerability. An attacker can exploit the vulnerability to hijack a valid user session via a specially crafted session cookie...

Shopware 授权问题漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. An authorization issue vulnerability exists in Shopware that stems from the lack of proper encryption of sessions in the system, which could allow an attacker to hijack a customer's session. The following...

Ice Hrm 授权问题漏洞

Ice Hrm is a human resource management system. Ice Hrm suffers from a session fixation vulnerability. An attacker can exploit the vulnerability to hijack a valid user session via a specially crafted session cookie...

Joomla 授权问题漏洞

Joomla is an open source, cross-platform content management system CMS developed using PHP and MySQL by the Open Source Matters team. A security vulnerability exists in Joomla! Core versions 1.5.0 through 1.5.15, which can be exploited by attackers to hijack arbitrary sessions and gain access to...

WebMO Job Manager v20.0 - Cross Site Web Vulnerability

Document Title: =============== WebMO Job Manager v20.0 - Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2270 Release Date: ============= 2021-06-21 Vulnerability Laboratory ID VL-ID: ==================================== 22...

CVE-2021-23845

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

Design/Logic Flaw

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

CVE-2021-23845

CVE-2021-23845 (Bosch B426 Conettix). The Bosch B426 family (e.g., B426, B426-CN/B429-CN, B426-M) has an authentication/session handling issue in the web configuration interface that allows session hijacking due to an improper access control design. Public descriptions confirm the vulnerability w...

Cisco Smart Switches Riddled with Security Holes

Cisco has flagged and patched several high-severity security vulnerabilities in its Cisco Small Business 220 Series Smart Switches that could allow session hijacking, arbitrary code execution, cross-site scripting and HTML injection. It also issued fixes for high-severity problems in the AnyConne...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting XSS attac...

CVE-2021-1571 Cisco Small Business 220 Series Smart Switches Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting XSS attac...

CVE-2021-1571

CVE-2021-1571 affects Cisco Small Business 220 Series Smart Switches’ web-based management interface. The issue stems from improper checks of parameter values, enabling multiple vulnerabilities: session hijacking, potential arbitrary command execution as root, cross-site scripting (XSS), and HTML...

CVE-2021-1541

CVE-2021-1541 affects Cisco Small Business 220 Series Smart Switches. Root cause: lack of parameter validation for TFTP configuration parameters in the web-based management interface, enabling an authenticated remote attacker to execute arbitrary commands as root. Also associated risks include se...