CVE-2024-0822 Ovirt: authentication bypass

An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command...

CVE-2024-0808

creationtimestamp| type| source ---|---|--- 2024-01-24 01:26:56+00:00| seen| https://t.me/ctinow/172456 2024-01-26 01:42:08+00:00| seen| https://t.me/ctinow/173937 2024-02-17 14:46:17+00:00| seen| https://t.me/ctinow/186938...

PT-2024-15841 · Unknown · Ovirt Engine

Name of the Vulnerable Software and Affected Versions: overt-engine affected versions not specified Description: An authentication bypass issue was found, allowing the creation of users in the system without authentication due to a flaw in the CreateUserSession command. Recommendations: At the...

Authentication flaw

The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session...

CVE-2023-49262 Buffer overflow vulnerability in Cookie authentication field

The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session...

CVE-2023-49262 Buffer overflow vulnerability in Cookie authentication field

The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session...

CVE-2023-50924 Stored XSS in Overview and Output fields

Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the...

Design/Logic Flaw

Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device...

CVE-2023-50707 Uncontrolled Resource Consumption in EFACEC BCU 500

Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device...

EFACEC BCU 500 Resource Management Error Vulnerability

The EFACEC BCU 500 is a programmable control system from EFACEC Portugal. The EFACEC BCU 500 suffers from a resource management error vulnerability that originates from the fact that by exploiting an active user session, an attacker can send a custom request to cause a denial of service on the...

User session fails to launch session Received an invalid packet during its ?? handshake phase

In System Event log on the VDA a TDICA event 1019 appears. "The Citrix TDICA Transport Driver connection from xxx.xxx.xxx.xxx: to port 443received an invalid packet during its ?? handshake phase" There is however no issue launching the session and no disconnection takes place. In this scenario th...

CVE-2023-6760 Thecosy IceCMS user session

A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this...

CVE-2023-6760

The CVE-2023-6760 entry applies to Thecosy IceCMS up to version 2.0.1. The vulnerability is described as affecting unknown code and enabling remote manipulation that leads to management of user sessions. Exploitation is noted as publicly disclosed. Connected sources corroborate impact on session ...

CVE-2023-6333

The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...

CVE-2023-6333

The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...

CVE-2023-6333

The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...

CVE-2023-6420

A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via signup2.php in the emailadd parameter, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an...

PT-2023-7322 · Unknown · Alumne Lms

Name of the Vulnerable Software and Affected Versions: Alumne LMS version 4.0.0.1.08 Description: A Cross-Site Scripting XSS issue has been found in Alumne LMS, where an attacker could exploit the localidad parameter to inject a custom JavaScript payload. This could allow the attacker to partiall...

Moxa PT-G503 Series Sensitive Cookie Not Properly Secured (CVE-2023-4217)

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation. This...

MOXA PT-G503 Unauthorized Access Vulnerability

MOXA PT-G503 is a series of Layer 2 managed switches from MOXA China. The MOXA PT-G503 unauthorized access vulnerability can be exploited by a remote attacker to submit a special request that can be used to gain unauthorized access to and manipulate user session data...