CVE-2021-29368: Session Fixation

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CVE-2021-29368

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CuppaCMS 授权问题漏洞

CuppaCMS is a content management system CMS. A security vulnerability exists in CuppaCMS that stems from the presence of a session fixation vulnerability, which can be exploited by an attacker to access arbitrary user sessions...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2023-05238)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting...

IBM Sterling B2B Integrator Standard Edition Cross-Site Scripting Vulnerability (CNVD-2023-05243)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates essential B2B processes, transactions and relationships. A cross-site scripting vulnerability exists in IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.1.2.1. An attacker could exploit the...

Debian dla-3256 : xdmx - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3256 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3256-1 [email protected]...

Arbitrary Command Execution

Shardingsphere-proxy is vulnerable to arbitrary code execution. The vulnerability exists because the mysql database backend fails to properly validate client authentication and does not clear out database sessions on time which allows an attacker to execute commands...

Fedora 36 : xorg-x11-server (2022-dd3eb7e0a8)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-dd3eb7e0a8 advisory. Fix buggy patch to CVE-2022-46340 ---- CVE fix for: CVE-2022-4283, CVE-2022-46340, CVE-2022-46341, CVE-2022-46342, CVE-2022-46343, CVE-2022-46344...

Remote Code Execution

xwayland is vulnerable to remote code execution. The handler for the ScreenSaverSetAttributes request may write to memory after it has been freed leading to local privileges elevation on systems where the server is running privileged and remote code execution for ssh X forwarding sessions...

IBM Security Verify Governance Identity Manager Cross-Site Scripting Vulnerability

IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes. version 10.0.1 of IBM Security Verify Governance Identity Manager is vulnerable to A cross-site scripting vulnerability exists. An...

CVE-2020-15679

An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP...

Session fixation

An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP...

Debian DSA-5304-1 : xorg-server - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5304 advisory. - A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in...

Insufficient Session Expiration

derhansen/fechangepwd uses insecure session management. The vulnerability exists because the updatePassword functions in FrontendUserService.php fails to revoke existing sessions for the current user when the password has been changed, allowing an attacker to bypass the authentication mechanism...

SUSE SLES15 Security Update : xorg-x11-server (SUSE-SU-2022:4481-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4481-1 advisory. - CVE-2022-46340: Server XTestSwapFakeInput stack overflow bsc1205874 - CVE-2022-46341: Server XIPassiveUngrabDevice out-of-bounds...

SUSE SLES15 Security Update : xorg-x11-server (SUSE-SU-2022:4482-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4482-1 advisory. - CVE-2022-46340: Server XTestSwapFakeInput stack overflow bsc1205874 - CVE-2022-46341: Server XIPassiveUngrabDevice out-of-bounds...

Siemens APOGEE/TALON Field Panels

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: APOGEE PXC/TALON TC Vulnerabilities: Predictable Exact Value from Previous Values 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to hijack...

CVE-2022-47406

An issue was discovered in the fechangepwd aka Change password for frontend users extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed...

Out-of-bounds

A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X serve...

CVE-2022-3073

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser...