PT-2023-31902 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to properly validate permissions when demoting and deactivating a user. This allows a system or user manager to demote or deactivate another...

CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

CVE-2023-42446

Pow is a Phoenix/Plug authentication library. CVE-2023-42446 affects Pow.Store.Backend.MnesiaCache in versions 1.0.14 up to, but not including, 1.0.34, where expired keys are not correctly invalidated on startup, allowing potential session hijacking if all MnesiaCache instances are down past a se...

CVE-2023-39452

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-39452

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-39446

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

CVE-2023-39446

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the we...

CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

CVE-2023-39446

The CVE-2023-39446 CSRF issue affects the Socomec MODULYS GP family web firmware (MOD3GP-SY-120K). Root cause: weaknesses in the web app’s user management allow an attacker to obtain header information to craft specially designed URLs and trigger actions when a legitimate user is logged in. Impac...

CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

Length limitation of "Associated User" username

Citrix DaaS Manage - Monitor - Trends - Sessions - Associated User only displays part of username...

CVE-2023-21523

A Stored Cross-site Scripting XSS vulnerability in the Management Console User Management and Alerts of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account...

CVE-2023-21523

A Stored Cross-site Scripting XSS vulnerability in the Management Console User Management and Alerts of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account...

Cross site scripting

A Stored Cross-site Scripting XSS vulnerability in the Management Console User Management and Alerts of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account...

CVE-2023-21523

CVE-2023-21523 describes a stored XSS vulnerability in the BlackBerry AtHoc Management Console (User Management and Alerts) affecting version 7.15. The issue allows an attacker to execute script commands in the context of the affected user account. Documented details confirm the vulnerability typ...

CVE-2023-21523

A Stored Cross-site Scripting XSS vulnerability in the Management Console User Management and Alerts of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account...