CVE-2023-34423

Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege...

Trellix ePolicy Orchestrator 跨站脚本漏洞

Trellix ePolicy Orchestrator is a centralized security management platform from Trellix. A security vulnerability exists in Trellix ePolicy Orchestrator versions prior to 5.10 SP1 Update 1, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability. The vulnerability can...

PT-2023-20026 · Papercut · Papercut Ng/Mf

Name of the Vulnerable Software and Affected Versions: PaperCut NG/MF versions affected versions not specified Description: A Cross-Site Request Forgery CSRF vulnerability exists in PaperCut NG/MF, potentially allowing an attacker to alter security settings or execute arbitrary code under specifi...

PT-2022-20488 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 9.5.34 ELTS TYPO3 versions prior to 10.4.29 TYPO3 versions prior to 11.5.11 Description: The issue concerns Admin Tool sessions in the TYPO3 backend user interface that were not revoked even if the corresponding user...

TYPO3 代码问题漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A code issue vulnerability exists in TYPO3 that stems from the fact that administrative tool sessions initiated through the TYPO3 back-end user interface are not revoked, and affects the...

CVE-2022-27629

Cross-site request forgery CSRF vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unspecified vectors...

Session fixation

An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-42545

CVE-2021-42545 : The TopEase Platform from Business-DNA Solutions GmbH is affected up to version 7.1.27 due to an insufficient session expiration issue that enables a remote attacker to reuse, spoof, or steal other user and admin sessions. The available documents identify the vulnerability as a s...

CVE-2021-38823

The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different browser...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

Vulnerability fixed in VMware Workspace ONE

VMware has fixed a vulnerability in Workspace ONE. The vulnerability allows a malicious party with access to /API/system/admins/session the ability to perform a Denial of Service execution. VMware categorizes this vulnerability according to the CVSSv3 method with a score of 5.8. VMware has releas...

CVE-2021-29012

DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid temporarily during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus...

CVE-2018-5405

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of oth...

Multiple Cross-Site Scripting Vulnerabilities in ImpressCMS

ImpressCMS is a popular content management system. Multiple cross-site scripting vulnerabilities exist in ImpressCMS. An attacker can exploit the vulnerabilities to execute arbitrary HTML and script code in an administrator's browser session in the context of an affected site...

Wallabag Application Cross-Site Scripting Vulnerability

Wallabag is a free and open source RSS reader. A cross-site scripting vulnerability exists in the configuration page of the Wallabag application in versions 2.2.3 through 2.3.2, which can be exploited by remote attackers to execute JavaScript code and steal administrator sessions...

CVE-2018-5705

Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine the t parameter to the /search URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By sending users an infected URL, code will ...

CVE-2017-12225

A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...

VulnCheck KEV: CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

UBUNTU-CVE-2015-5335

Cross-site request forgery CSRF vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub U...