Design/Logic Flaw

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

CVE-2018-0382 Cisco Wireless LAN Controller Software Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

Cisco Wireless LAN Controller Software Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

JioFi 4G M2S 1.0.2 - Cross-Site Request Forgery

Exploit Title: JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi Exploit Author: Vikas Chaudhary Date: 21-01-2019 Vendor Homepage: https://www.jio.com/ Hardware Link:...

Open Source Point Of Sale Stored XSS

The Open Source Point of Sale POS application running on the remote web server is vulnerable to a Stored XSS vulnerability. - A Stored cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker ca...

NVIDIA GeForce Experience Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-25444 Potential Impact: Privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE‑2018‑6263, CVE‑2018‑6265, CVE‑2018‑6266 Summary Description: NVIDIA has released a software update for GeForce Experience. This upda...

PT-2019-16778

Name of the Vulnerable Software and Affected Versions Nessus versions 8.2.1 and earlier Description The issue is due to improper validation of user-supplied input, leading to a stored XSS vulnerability. An authenticated, remote attacker could exploit this via a specially crafted request to execut...

CVE-2018-1962

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658...

Session fixation

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658...

CVE-2018-1962

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658...

Apache Tomcat < 6.0.6 Cross-Site Scripting

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.6. It is, therefore, affected by the following vulnerability : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returnin...

Design/Logic Flaw

NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 during application installation on Windows 7 in elevated privilege mode, where a local user who initiates a browser session may obtain escalation of privileges on the browser...

CVE-2018-6265

NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 during application installation on Windows 7 in elevated privilege mode, where a local user who initiates a browser session may obtain escalation of privileges on the browser...

CVE-2018-6265: Undefined Security Weakness

NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 during application installation on Windows 7 in elevated privilege mode, where a local user who initiates a browser session may obtain escalation of privileges on the browser...

Joomla! 3.1.x < 3.7.3 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input with multibyte characters. An unauthenticated, remote attacker can exploit...

WordPress 4.4.x < 4.4.8 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists in the wpplaylistshortcode function within the /wp-includes/media.php script due to a failure to validate input passed via...

Joomla! 1.7.x < 3.7.0 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A flaw exists in the JMail API due to PHPMail version information being included in mail headers. An unauthenticated, remote attacker can exploit this to disclose sensitive...

WordPress 4.2.x < 4.2.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the class-wp-press-this.php script due to a failure to properly restrict the user interface for assigning taxonomy terms...

Rockwell Automation Allen-Bradley CompactLogix Cross-Site Scripting (CVE-2016-2279)

A cross site scripting vulnerability has been reported in Rockwell Scada System. The vulnerability is due to lack of sanitization of user supplied input data. A remote attacker can exploit this vulnerability to execute arbitrary HTML and script code in a browser session in the context of the...

Apache Struts 2.0.x < 2.2.1 <s:url> and <s:a> Tag XSS (S2-002)

The version of Apache Struts running on the remote host is 2.0.x prior to 2.2.1. It is, therefore, affected by a possible cross-site scripting XSS vulnerability due to improper validation of user-supplied input to and tags. An unauthenticated, remote attacker can exploit this, by convincing a use...