OPPO Wallet 访问控制错误漏洞

OPPO Wallet is a mobile wallet application developed by OPPO Corporation in China. It integrates payment, card and coupon management, as well as digital lifestyle services. OPPO Wallet has a access control vulnerability, which stems from a trust domain verification flaw. This vulnerability could...

PT-2026-35363

OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure...

PT-2026-25887

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.7 Description The session token token in cookies for Apache Airflow is set to path=/ regardless of the configured base url for the webserver or api. This allows any application co-hosted under the same...

📄 Appsmith 1.92 Origin Header Injection

A critical vulnerability in Appsmith version 1.92 allows an unauthenticated attacker to manipulate the Origin HTTP header during the password reset process. Due to improper trust in client‑supplied headers, Appsmith constructs password reset links based on the injected origin. This enables an...

CVE-2025-64386

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...

CVE-2025-64386 HIJACKING OF THE TOKEN AND GAINING ACCESS

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...

EUVD-2018-2948

Malware in sbrugna...

EUVD-2019-2058

Malware in sbrugna...

EUVD-2022-29052

Malicious code in bioql PyPI...

CVE-2019-1020010

Misskey before 10.102.4 allows hijacking a user's token...

@better-auth/cli (>=1.0.0-canary.2, <=1.1.20), @silgi/better-auth (>=0.0.5, <=0.0.12) +1 more potentially affected by CVE-2025-71403 via better-auth (>=1.0.0, <=1.1.20-beta.5)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.5, =1.1.368, =1.1.416 Source cves: CVE-2025-71403 Source advisory: OSV:GHSA-VP58-J275-797X...

CVE-2024-1610

The OPPO Store App (specifically version 4.32.1 ) is susceptible to a possible escalation of privilege due to improper input validation . This vulnerability could allow an attacker to gain unauthorized access levels. While a fix is recommended, the documents do not specify a newer patched version...

CVE-2024-1610 OPPO Store app include remote account token hijacking and sensitive information leakage

In OPPO Store APP, there's a possible escalation of privilege due to improper input validation...

CVE-2023-31238

A vulnerability has been identified in SICAM P850 7KG8500-0AA00-0AA0 All versions V3.11, SICAM P850 7KG8500-0AA00-2AA0 All versions V3.11, SICAM P850 7KG8500-0AA10-0AA0 All versions V3.11, SICAM P850 7KG8500-0AA10-2AA0 All versions V3.11, SICAM P850 7KG8500-0AA30-0AA0 All versions V3.11, SICAM P8...

Malicious npm Code Packages Built for Hijacking Discord Servers

A series of malicious packages in the Node.js package manager npm code repository are looking to harvest Discord tokens, which can be used to take over unsuspecting users’ accounts and servers. The npm repository is an open-source home for JavaScript developers to share and reuse code blocks. The...

PT-2021-15170

Name of the Vulnerable Software and Affected Versions WebAccess/SCADA versions prior to 8.4.5 WebAccess/SCADA versions prior to 9.0.1 Description The issue concerns a cross-site scripting XSS vulnerability in the UserExcelOut.asp file within WebAccess/SCADA. This vulnerability could allow an...

CVE-2021-20992

CVE-2021-20992 affects Fibaro Home Center 2 and Lite devices, where the web-based management interface runs over unencrypted HTTP. This enables eavesdropping on user communications and can allow hijacking of sessions, tokens, and passwords. The available sources confirm the issue but do not provi...

Fibaro Home Center 2 安全漏洞

FIBARO Home Center 2 is an application system of the Polish company FIBARO. A system integration system. A security vulnerability exists in Fibaro Home Center 2 that stems from the fact that communications between users and devices can be eavesdropped on to hijack sessions, tokens, and passwords...

Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS Vulnerability

Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS Exploit Author: Captainhook Vendor Homepage: https://www.atlassian.com/ Version: 4.10.0 Tested on: All OS CVE: CVE-2020-14166 Summary: The /servicedesk/customer/portals resource in Jira Service Desk Server and Data...

Security Bulletin: IBM Security Information Queue does not invalidate sessions after logout (CVE-2020-4291)

Summary IBM Security Information Queue ISIQ session identifiers are not properly invalidated upon user logout from ISIQ's web UI. This create opportunities for an attacker to hijack a user session token. As of v1.0.6, ISIQ immediately invalidates the session token when a user logs out...