Vulnerability fixed in Zoom

A vulnerability has been fixed in Zoom. The vulnerability allows a malicious person to bypass a security measure and gain access to sensitive data. To exploit the vulnerability, a malicious person needs to victim to open a rogue link. This enables the malicious party to perform further attacks su...

CVE-2022-40226

A vulnerability has been identified in SICAM P850 7KG8500-0AA00-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA00-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA30-0AA0 All versions V3.10, SICAM P8...

CVE-2022-40226

A vulnerability has been identified in SICAM P850 7KG8500-0AA00-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA00-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA30-0AA0 All versions V3.10, SICAM P8...

PT-2022-25294 · Siemens · Sicam P855 +1

Name of the Vulnerable Software and Affected Versions: SICAM P850 versions prior to V3.10 SICAM P855 versions prior to V3.10 Description: A vulnerability has been identified in the affected devices, which accept user-defined session cookies and do not renew the session cookie after login/logout...

CVE-2022-40622

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

CVE-2022-40622

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

Code injection

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

CVE-2022-40622

The CVE-2022-40622 entry concerns WAVLINK Quantum D4G (WN531G3) firmware M31G3.V5030.200325, where the device uses IP addresses to maintain sessions and does not employ session tokens. This design enables session takeover if an attacker can match the administrator’s IP or share a NAT, as describe...

CVE-2022-40622 WAVLINK Quantum D4G (WN531G3) Session Management by IP Address

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

WAVLINK WN531G3 授权问题漏洞

The WAVLINK WN531G3 is a wireless router from the Chinese company WAVLINK. A security vulnerability exists in the WAVLINK WN531G3 firmware version M31G3.V5030.200325 and prior versions, which stems from the use of an IP address to maintain a session and does not use a session token, and can be...

PT-2022-5032 · Wavlink · Wavlink Quantum D4G

Name of the Vulnerable Software and Affected Versions: WAVLINK Quantum D4G WN531G3 version M31G3.V5030.200325 Description: The issue is related to the authentication procedure in the WAVLINK Quantum D4G WN531G3 Wi-Fi router. The device uses IP addresses to hold sessions and does not utilize sessi...

Nortek Control Linear eMerge E3-Series 授权问题漏洞

The Nortek Control Linear eMerge E3-Series is an access control from Nortek Control USA. It allows you to specify which doors a person can use to enter and exit a specified location at a specified time. An authorization issue vulnerability exists in Nortek Control Linear eMerge E3-Series version...

CVE-2022-24781 Malicious users can take over the session of other players

Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists...

CVE-2021-27416

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management EAM versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of...

CVE-2021-27416

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management EAM versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of...

CVE-2021-27416

CVE-2021-27416 affects Hitachi ABB Power Grids Ellipse EAM, prior to and including 9.0.25. The issue is cross-site scripting: an attacker entices a user to click a malicious link, potentially exposing confidential data or hijacking a session. Mitigation per multiple sources: update to Ellipse EAM...

CVE-2021-27416 Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management EAM versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of...

Siemens SICAM MMU, SICAM T, and SICAM SGU Improper Neutralization of Input During Web Page Generation (CVE-2020-10041)

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. A stored Cross-Site-Scripting XSS vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user...

WordPress 跨站脚本漏洞

WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in WordPress plugin GDPR versions prior to 1.9.26. An attacker utilizing Javascript code may be able to execute on the victim's browser. If the victim is an administrator with a valid...

Mageia: Security Advisory (MGASA-2014-0094)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...