CVE-2020-5224 Session key exposure through session list in Django User Sessions

In Django User Sessions django-user-sessions before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the...

CVE-2020-5224

In Django User Sessions (django-user-sessions) before 1.7.1, the session management views render the session key in HTML, enabling an attacker to exfiltrate the key via an XSS payload in the presence of a vulnerable site. This can lead to session takeover. Affected component: django-user-sessions...

CVE-2020-5224

In Django User Sessions django-user-sessions before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the...

Session key exposure through session list in Django User Sessions

Impact The views provided by django-user-sessions allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted ...

PT-2020-18320

Name of the Vulnerable Software and Affected Versions django-user-sessions versions prior to 1.7.1 Description The views provided by django-user-sessions allow users to terminate specific sessions, and the session key is included in the rendered HTML. This is not a problem in itself, but if the...

CVE-2020-5224: Improper Authentication

In Django User Sessions django-user-sessions before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the...

Zomato: Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com

Intro Hi Zomato Security Team! My name is Evan Custodio and this is my first time evaluating your platform. I specialize in looking for server-side vulnerabilities. Recently I've taken a deep look at HTTP Request Smuggling issues. I have custom tools to evaluate over 150 types of HTTP Smuggling...

D-Link DIR-615 Authorization Issues Vulnerability

D-Link DIR-615 is a small wireless router product from AUO D-Link. The D-Link DIR-615 is vulnerable to an authorization issue. An attacker can exploit this vulnerability by sniffing network traffic to obtain the IP address of the user and the router, or even obtain a public IP address and take ov...

PT-2019-13547

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.1 through 7.10.2 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or tak...

PT-2019-8502

Name of the Vulnerable Software and Affected Versions my-wp-translate plugin versions prior to 1.0.4 Description The issue allows for cross-site scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations For versions prior to...

Metasploit Reverse Session Takeover Vulnerability

Exploit for multiple platform in category local exploits Exploit Title: Metasploit Reverse Session Takeover Exploit Author: Social Engineering Neo - @EngineeringNeo Software Link: https://www.metasploit.com/download Version: Metasploit Pro v4.17.67-dev Tested on: Linux & Windows Metasploit Revers...

PT-2019-9075

Name of the Vulnerable Software and Affected Versions LOYTEC LGATE-902 version 6.3.2 Description The issue allows for Cross-Site Scripting XSS attacks. XSS is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take contr...

CVE-2018-5405

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of oth...

PT-2019-10964

Name of the Vulnerable Software and Affected Versions: Quest Kace K1000 Appliance versions prior to 9.0.270 Description: The issue allows an authenticated user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. This could enable a malicious user t...

CVE-2018-5405: Improper Neutralization of Input During Web Page Generation

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of oth...

PT-2019-8016

Name of the Vulnerable Software and Affected Versions Open-Xchange GmbH OX App Suite versions 7.8.4 and earlier Description The issue is related to Cross Site Scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations For version...

Session Takeover

jenkins is vulnerable to session takeover. The vulnerability exists as clickjacking attacks were possible...

BlackBerry UEM Management Console Information Disclosure Vulnerability

BlackBerry UEM is a unified endpoint management solution from BlackBerry Canada. The solution is used to manage endpoint devices and view their access.Management Console is one of the management console programs. An information disclosure vulnerability exists in Management Console in BlackBerry U...

CVE-2018-8890

An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user...

CVE-2018-8890

An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user...