Lucene search
+L

4499 matches found

Microsoft CVE
Microsoft CVE
•added 2025/09/03 9:50 p.m.•9 views

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

...

7.5CVSS7AI score0.00685EPSS
SaveExploits0
RedhatCVE
RedhatCVE
•added 2025/08/30 6:18 p.m.•14 views

CVE-2025-34157

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to...

9.4CVSS5.6AI score0.00462EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2025/08/30 6:18 p.m.•11 views

CVE-2025-30039

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges...

9CVSS6.9AI score0.00176EPSS
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
•added 2025/08/29 6:55 p.m.•6 views

Malicious code in sessions-logger (npm)

The package sessions-logger was found to contain malicious code...

7AI score
SaveExploits0
OSV
OSV
•added 2025/08/29 6:55 p.m.•6 views

MAL-2025-42083 Malicious code in sessions-logger (npm)

The package sessions-logger was found to contain malicious code...

7AI score
SaveExploits0
OSV
OSV
•added 2025/08/29 2:52 p.m.•12 views

GO-2025-3904 Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server

Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

6.8CVSS7AI score0.00301EPSS
SaveExploits0References3
CNVD
CNVD
•added 2025/08/29 12:00 a.m.•14 views

CGM CLININET Access Control Error Vulnerability (CNVD-2025-19807)

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from an access control error vulnerability that originates from improper access control in /cgi-bin/CliniNET.prd/GetActiveSessions.pl, which can be exploited by an attacker to gain unauthorized access ...

9.4CVSS6.8AI score0.00247EPSS
SaveExploits0References1
CNVD
CNVD
•added 2025/08/29 12:00 a.m.•47 views

CGM CLININET Trust Management Issue Vulnerability

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a trust management issue vulnerability that stems from the decodeParam function not verifying the signature algorithm, which can be exploited by an attacker to generate arbitrary user sessions...

9.4CVSS6.8AI score0.00247EPSS
SaveExploits0References1
BDU FSTEC
BDU FSTEC
•added 2025/08/29 12:00 a.m.•19 views

The vulnerability of the online business analytics service IBM Cognos Analytics, related to the lack of measures taken to protect the website structure, allows attackers to disclose account information during a secure session.

The vulnerability of the online business analytics service IBM Cognos Analytics is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to obtain login credentials during a secure session...

6.4CVSS5.8AI score0.00187EPSS
SaveExploits0References2Affected Software1
NVD
NVD
•added 2025/08/27 5:15 p.m.•20 views

CVE-2025-34157

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to...

9.4CVSS0.00462EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2025/08/27 4:48 p.m.•12 views

CVE-2025-34157 Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to...

9.4CVSS5.3AI score0.00462EPSS
SaveExploits0References3
attackerkb
attackerkb
•added 2025/08/27 4:48 p.m.•6 views

CVE-2025-34157

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to...

9.4CVSS5.7AI score0.00462EPSS
SaveExploits0References4
CVE
CVE
•added 2025/08/27 4:48 p.m.•45 views

CVE-2025-34157

CVE-2025-34157 concerns Coolify. A stored XSS in the project-creation workflow affects versions prior to 4.0.0-beta.420.6. An authenticated user with low privileges can craft a project name containing JavaScript, which when an administrator deletes the project executes in the admin context, enabl...

9.4CVSS5.3AI score0.00462EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
•added 2025/08/27 4:48 p.m.•31 views

CVE-2025-34157 Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to...

9.4CVSS0.00462EPSS
SaveExploits0References3
NVD
NVD
•added 2025/08/27 11:15 a.m.•32 views

CVE-2025-30064

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to genera...

8.8CVSS0.00085EPSS
SaveExploits0References1
CVE
CVE
•added 2025/08/27 10:25 a.m.•35 views

CVE-2025-30064

Technical details about CVE-2025-30064 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories; current sources do not reveal affected products, versions, or remediation steps.

8.8CVSS6.2AI score0.00085EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2025/08/27 10:20 a.m.•13 views

CVE-2025-30039 Missing authentication in API returning a list of all active sessions

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges...

9CVSS0.00176EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2025/08/27 10:20 a.m.•4 views

CVE-2025-30039 Missing authentication in API returning a list of all active sessions

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges...

9CVSS7.1AI score0.00176EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2025/08/27 12:00 a.m.•15 views

PT-2025-34846 · Clininet · Clininet

Name of the Vulnerable Software and Affected Versions: CliniNET affected versions not specified Description: Unauthenticated access to the /cgi-bin/CliniNET.prd/GetActiveSessions.pl endpoint allows takeover of any user session logged into the system, including those with administrative privileges...

9.4CVSS5.8AI score0.00247EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2025/08/27 12:00 a.m.•22 views

PT-2025-34858 · Unknown · Verifyuserbythrustedservice

Name of the Vulnerable Software and Affected Versions: versions prior to 2.3 Description: An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. An attacker can use th...

9.4CVSS6.1AI score0.00247EPSS
SaveExploits0References5
Rows per page
Query Builder