416 matches found
Authentication Bypass
Central Dogma is vulnerable to Authentication Bypass. The vulnerability is due to improper sanitization of the relayState within the SAML request. This issue can be exploited by an attacker to leak user sessions thus leading to authentication bypass...
Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-34q3-p352-c7q8. This link is maintained to preserve external references. Original Description Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage o...
CVE-2024-1143
Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...
Cross site scripting
Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...
CVE-2024-1143
Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...
CVE-2024-1143
Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...
CVE-2024-23892
A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/costcentercreate.php, in the costcenterid parameter. Exploitation of this...
The vulnerability of cloud software for creating and using Nextcloud Server’s data storage solution lies in the incorrect expiration time of user sessions, which allows attackers to intercept user sessions.
The vulnerability of cloud software for creating and using Nextcloud Server storage solutions is related to incorrect session duration. Exploiting this vulnerability can allow attackers to intercept user sessions...
CVE-2023-50707
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device...
CVE-2023-50707
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device...
CVE-2023-50707
CVE-2023-50707 affects EFACEC BCU 500 (EC/automation control IED). The vulnerability enables uncontrolled resource consumption (DoS) by exploiting active user sessions to send custom requests, leading to device denial of service (impact as described in Red Hat/CISA/EFACEC advisories). Affected pr...
PT-2023-31613 · Efacec · Bcu 500 +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows an attacker to send custom requests to cause a denial-of-service condition on the device through the exploitation of active user...
Allocation of Resources Without Limits in Keycloak
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...
Memory corruption
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...
CVE-2023-6563
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...
CVE-2023-6760
A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this...
Design/Logic Flaw
A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this...
PT-2023-31237 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A cross-site scripting XSS issue was found in the article management department. This could potentially allow attackers to inject malicious scripts into websites, affecting user sessions. Recommendations...
