CVE-2024-10723 Stored XSS in phpipam/phpipam

A stored cross-site scripting XSS vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact of this...

CVE-2024-11638

CVE-2024-11638 affects the WordPress plugin Gtbabel (versions before 6.6.9). Root cause: it does not verify that the URL to analyze is within the blog, enabling unauthenticated attackers to trigger requests that can capture a logged-in user’s cookies (e.g., admin). Impact: potential admin cookie ...

PYSEC-2025-6 Exfiltrates cookies to hardcoded IP address

Published in 2021, the colabrun package is a Python library that exfiltrates user cookies to a hardcoded IP address. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes...

PYSEC-2025-5 Exfiltrates user cookies to hardcoded server endpoint during normal operations

Published in 2020, the autodzee package is a Python library that bypasses Deezer API restrictions to download music. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes...

CVE-2024-5478

A Cross-site Scripting XSS vulnerability exists in the SAML metadata endpoint /auth/saml/$org?.id/metadata of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the orgId parameter supplied by the user before incorporating it into the...

Siemens Industrial Edge Management Cross-Site Scripting Vulnerability

Industrial Edge represents an open, ready-to-use edge computing platform consisting of edge devices, edge applications, edge connectivity, and application and device management infrastructure. A cross-site scripting vulnerability exists in Siemens Industrial Edge Management, which can be exploite...

XSS Vulnerability in StarRocks Database System of Beijing Mirror Boat Technology Co.

StarRocks database system is a new generation of open source extremely fast full-scene MPP database system . Beijing Mirror Boat Technology Co. StarRocks database system has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

XSS Vulnerability in StarRocks Database System of Beijing Mirror Boat Technology Co.

StarRocks database system is a new generation of open source extremely fast full-scene MPP database system . Beijing Mirror Boat Technology Co., Ltd StarRocks database system has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

Async Http Client 授权问题漏洞

Async Http Client is AsyncHttpClient open source asynchronous Http and WebSocket client library for Java. An authorization issue vulnerability exists in Async Http Client version 3.0.0, which stems from an automatically enabled and self-managed CookieStore handling mechanism that can lead to...

XSS Vulnerability in Mingguo Security Gateway of Hangzhou ACE Information Technology Co.

MingGuard Security Gateway is a next-generation security protection system with full-process defense, which is an intelligent gateway integrating traditional firewall, intrusion prevention system, anti-virus gateway, Internet behavior control, VPN gateway, threat intelligence and other security...

CVE-2022-1226 Cross-site Scripting (XSS) in phpipam/phpipam

A Cross-Site Scripting XSS vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include...

CVE-2022-1226 Cross-site Scripting (XSS) in phpipam/phpipam

A Cross-Site Scripting XSS vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include...

Guizhou small code technology limited company jpress exist file upload vulnerability

jpress is a complete Java CMS web management system. Ltd. jpress has a file upload vulnerability, which can be exploited by attackers to obtain sensitive information such as user cookies by uploading files...

CVE-2024-6078 Rockwell Automation Authentication Bypass Vulnerability in DataMosaix™

CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any user ID without the use of a username or password. If exploited, a malicious user could take over the account of a legitimate user. The...

XSS Vulnerability in TM241CE24T_U at Schneider Electric (China) Co.

Schneider Electric China Co., Ltd. is a globalized electrical company and a global expert in energy efficiency management and automation. An XSS vulnerability exists in Schneider Electric China TM241CE24TU, which can be exploited by attackers to obtain sensitive information such as user cookies...

XSS Vulnerability in SuperMap iServer of Beijing SuperMap Software Co.

SuperMap iServer is a cloud GIS application server based on high-performance cross-platform GIS kernel. XSS vulnerability exists in SuperMap iServer of Beijing SuperMap Software Co. Ltd, which can be exploited by attackers to obtain sensitive information such as user cookies...

Lunary Cross-Site Scripting Vulnerability

lunary is lunary open source a production toolkit for LLM . lunary has a cross-site scripting vulnerability , the vulnerability stems from the failure to escape or validate the user-supplied orgId parameter , an attacker can use the vulnerability to steal user cookies or authentication tokens...

Hangzhou Berten Technology Co., Ltd. Berten's "Total Entrepreneurship" Innovation and Entrepreneurship Training Platform Has XSS Vulnerabilities

Hangzhou Berten Technology Co., Ltd. is China's Business Simulation Business Simulation real-world platform and course provider. Ltd. Berten "entrepreneurship mobilization" innovation and entrepreneurship training platform XSS vulnerability, attackers can use the vulnerability to obtain user...

GHSA-RPX8-FG6W-RM6X Withdrawn Advisory: lunary-ai/lunary XSS in SAML metadata endpoint

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

CVE-2024-5478

A Cross-site Scripting XSS vulnerability exists in the SAML metadata endpoint /auth/saml/$org?.id/metadata of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the orgId parameter supplied by the user before incorporating it into the...