CVE-2023-40235

An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the namespace does not match the expected ArchiMate URL, the parser will access the provided resource. If the provided resource is a UNC path pointing to a share...

CVE-2023-24477

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session...

CVE-2023-24477 Session Fixation in Guardian/CMC before 22.6.2

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session...

CVE-2023-37499

A Persistent Cross-site Scripting XSS vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks...

CVE-2023-37499 A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform

A Persistent Cross-site Scripting XSS vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks...

Netdisco 跨站脚本漏洞

Netdisco is a web-based network management tool. A security vulnerability exists in versions prior to Netdisco v2.063000, which stems from a cross-site scripting attack XSS vulnerability in the component /Web/TypeAhead.pm in Netdisco. An attacker could use this vulnerability to attack a user's...

Citrix Cloud - Setting admin timeouts in Citrix Cloud portal

Requirement to know what the current timeout limit is when using Citrix Cloud and if it is possible to change the limit with regards to a Cloud Studio Admin session. Need to be able to force the user to have to login again after a certain amount of time...

CVE-2023-28001

An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API...

CVE-2023-36917 Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impa...

Menubar < 5.9 - Cross-Site Request Forgery

The plugin does not properly implement anti-CSRF measures, potentially making it possible for unwanted actions to be performed in the user's session...

CVE-2023-36289

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST emailcreate and back parameter...

SAP CRM ABAP Cross-Site Scripting Vulnerability

SAP CRM is a customer relationship management system from SAP in Germany. A cross-site scripting vulnerability exists in SAP CRM ABAP, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive information or hijack a user session when...

CVE-2023-0041

IBM Security Guardium 11.5 is affected by CVE-2023-0041, where insufficient session expiration could allow a user to take over another user’s session. Connected sources also indicate Guardium 11.3/11.4/11.5 were affected; remediation is available via IBM FixCentral (links shown in sources), thoug...

Nextcloud 代码问题漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud server, which stems from a session handling regression between Nextcloud Server and the Nextcloud Text application tha...

Rockwell Automation ArmorStart ST Cross-Site Scripting Vulnerability

Rockwell Automation ArmorStart ST is a simple and cost-effective solution for machine-side control architectures from Rockwell Automation. The Rockwell Automation ArmorStart ST suffers from a cross-site scripting vulnerability that can be exploited by a remote attacker to inject malicious script ...

Rockwell Automation ArmorStart ST Cross-Site Scripting Vulnerability (CNVD-2023-44288)

Rockwell Automation ArmorStart ST is a simple and cost-effective solution for machine-side control architectures from Rockwell Automation. The Rockwell Automation ArmorStart ST suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious script or HTM...

CVE-2023-30742 Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

SAP CRM WebClient UI - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting...

Jedox 2022.4.2 RPC Interface Remote Code Execution

Exploit Title: Jedox 2022.4.2 - Code Execution via RPC Interfaces Date: 28/04/2023 Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL Vendor Homepage: https://jedox.com Version: Jedox 2022.4 22.4.2 and older CVE : CVE-2022-47879 Introduction...

Cross-site Scripting (XSS) in DataObject columns grid

Impact The attacker is capable to stolen the user session cookie. it will leads to complete account takeover. Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/aa38319e353cc3cdfac12e03e21ed7a8f3628d3e.patch Workarounds Apply patch...

Code injection

Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain...