171 matches found
pwn-pulse
pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability CVE-2019-11510 Script authored by braindead @BishopFox. Based on research by Orange Tsai and Meh Chang. Thanks also to Alyssa Herrera and 0xDezzy for additional insights. Huge thanks to bl4ckh0l3z for fixing,...
Weak HTTP Strict-Transport-Security - Detect
Detected HTTP Strict-Transport-Security header with a weak max-age value less than one year. A low max-age reduces the effectiveness of HSTS, leaving users vulnerable to protocol downgrade attacks and cookie hijacking during the gap period. !/usr/bin/env python3 -- coding: utf-8 -- """Detected HT...
Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication
The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to 15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their authentication cookie replaced with an authentication cookie from...
Session Fixation
Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Session Fixation via /proxy reverse proxy requests. A malicious HF Space can hijack user sessions and gain unauthorized access to other users'...
CVE-2021-47923
OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized...
CVE-2021-47923 OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie
OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized...
CVE-2021-22676
UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting XSS, which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA...
Host Header Injection
Backdrop CMS is vulnerable to Host Header Injection. The vulnerability is due to improper validation of the Host header in password reset requests, which allows an attacker to manipulate redirects to malicious domains and potentially perform session hijacking via cookie injection...
Backdrop CMS Host Header Injection vulnerability
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
CVE-2025-63828
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
CVE-2025-63828
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
EUVD-2006-3660
Malware in sbrugna...
EUVD-2020-29884
Malware in sbrugna...
EUVD-2001-0840
Malware in sbrugna...
EUVD-2019-0420
Malware in sbrugna...
EUVD-2018-3017
Malware in sbrugna...
EUVD-2023-46281
Malicious code in bioql PyPI...
EUVD-2024-17257
Malicious code in bioql PyPI...