1667 matches found
CVE-2025-25748
A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...
@better-auth/cli (>=1.0.0-canary.2, <=1.1.20), @silgi/better-auth (>=0.0.5, <=0.0.12) +1 more potentially affected by CVE-2025-71403 via better-auth (>=1.0.0, <=1.1.20-beta.5)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.5, =1.1.368, =1.1.416 Source cves: CVE-2025-71403 Source advisory: OSV:GHSA-VP58-J275-797X...
Leantime allows Refelected Cross-Site Scripting (XSS)
Summary The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation...
CVE-2024-45386
A vulnerability has been identified in SIMATIC PCS neo V4.0 All versions, SIMATIC PCS neo V4.1 All versions V4.1 Update 2, SIMATIC PCS neo V5.0 All versions V5.0 Update 1, SIMOCODE ES V19 All versions V19 Update 1, SIRIUS Safety ES V19 TIA Portal All versions V19 Update 1, SIRIUS Soft Starter ES...
CVE-2024-45386
A vulnerability has been identified in SIMATIC PCS neo V4.0 All versions, SIMATIC PCS neo V4.1 All versions V4.1 Update 2, SIMATIC PCS neo V5.0 All versions V5.0 Update 1, SIMOCODE ES V19 All versions V19 Update 1, SIRIUS Safety ES V19 TIA Portal All versions V19 Update 1, SIRIUS Soft Starter ES...
CVE-2024-45386
A vulnerability has been identified in SIMATIC PCS neo V4.0 All versions, SIMATIC PCS neo V4.1 All versions V4.1 Update 2, SIMATIC PCS neo V5.0 All versions V5.0 Update 1, SIMOCODE ES V19 All versions V19 Update 1, SIRIUS Safety ES V19 TIA Portal All versions V19 Update 1, SIRIUS Soft Starter ES...
CVE-2024-45386
The CVE-2024-45386 entry concerns Siemens SIMATIC PCS neo (v4.0, v4.1 < Update 2, v5.0 < Update 1), SIMOCODE ES v19 (< Update 1), SIRIUS Safety ES v19 (TIA Portal) (< Update 1), SIRIUS Soft Starter ES (TIA Portal) (< Update 1), and TIA Administrator (
Siemens SIMATIC PCS和Siemens TIA Administrator 代码问题漏洞
Siemens TIA Administrator and Siemens SIMATIC PCS are both products of Siemens, Germany.Siemens TIA Administrator is a management program for authorizing and licensing SIMATIC products.Siemens SIMATIC PCS is a Siemens SIMATIC PCS is a process control system. A code issue vulnerability exists in...
Siemens SIMATIC PCS neo, TIA Administrator, and TIA Portal
SUMMARY Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Siemens has released new versions for several...
CVE-2024-51492
Zusam is a free and open-source way to self-host private forums. Prior to version 0.5.6, specially crafted SVG files uploaded to the service as images allow for unrestricted script execution on raw image load. With certain payloads, theft of the target user’s long-lived session token is possible...
CVE-2024-28134
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as...
CloudFoundry UAA 安全漏洞
CloudFoundry UAA is a multi-tenant identity management service from the CloudFoundry Foundation. A security vulnerability exists in CloudFoundry UAA that stems from an inability to properly validate session information between regions. An attacker exploiting this vulnerability could reuse its...
The vulnerability of the Session Token Handler component of the software platform based on Git for collaborative code development on GitLab allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Session Token Handler component in the Git-based software development platform, which is used for collaborative code development on GitLab, is related to context switching errors during privilege handling. Exploiting this vulnerability can allow an attacker, operating...
CVE-2024-42171
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...
CVE-2024-42171 HCL MyXalytics is affected by insufficient session expiration
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...
CVE-2024-42170 HCL MyXalytics is affected by a session fixation vulnerability
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...
CVE-2024-42171: Session Fixation
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...
CVE-2024-42170: Session Fixation
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...
CVE-2025-22387
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...
CVE-2025-22387: Use of GET Request Method With Sensitive Query Strings
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...