WonderCMS ADMIN LOGIN URL Parameter Cross-Site Scripting Vulnerability

WonderCMS is an open source PHP-based content management system CMS. A cross-site scripting vulnerability exists in WonderCMS v3.4.3, which stems from the lack of effective filtering and escaping of user-supplied data in the ADMIN LOGIN URL parameter of the Settings section, which can be exploite...

CVE-2024-22811

An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service DoS by disrupting the communication between the PathPilot controller and the CNC router via overwriting the Hostmot2 configuration cookie in the device memory...

CVE-2024-22811

CVE-2024-22811 affects the Tormach xsTECH CNC Router with PathPilot Controller v2.9.6. The issue allows a remote attacker to cause a Denial of Service by disrupting the communication between the PathPilot controller and the CNC router through overwriting the Hostmot2 configuration cookie in devic...

Fedora 39 : php (2024-b46619f761)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b46619f761 advisory. PHP version 8.2.18 11 Apr 2024 Core: Fixed bug GH-13612 Corrupted memory in destructor with weak references. nielsdos Fixed bug GH-13784...

EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2024-1543)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - This flaw allows a malicious HTTP server to set 'super cookies' in curl that are then passed back to more origins than what is...

CVE-2024-22186

The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator...

CVE-2024-21872

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter...

CVE-2024-3741

Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full system access...

CVE-2024-21872 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter...

CVE-2024-21872 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter...

CVE-2024-21872

The CVE-2024-21872 vulnerability affects Electrolink FM/DAB/TV Transmitter devices, arising from Reliance on Cookies without Validation and Integrity Checking. An unauthenticated attacker can bypass login and modify the cookie to access hidden pages and perform more critical transmitter operation...

CVE-2024-22186 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator...

CVE-2024-22186 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator...

CVE-2024-22186

CVE-2024-22186 affects Electrolink FM/DAB/TV Transmitters (multiple 10W–30kW models) and is a cookie-based privilege-escalation vulnerability. An attacker with guest access can poison the login cookie to elevate to administrator, enabling full system access and potentially other critical actions....

CVE-2024-3741 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data

Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full system access...

CVE-2024-3741 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data

Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full system access...

CVE-2024-3741

Summary : CVE-2024-3741 affects Electrolink FM/DAB/TV Transmitters and is an authentication-bypass vulnerability in the login cookie, allowing an attacker to gain full system access by setting an arbitrary cookie value other than 'NO'. Affected products : A wide range of Electrolink transmitters ...

HackerOne: Session Not Expire / 2FA Bypass

Vulnerability description not provided...

Electrolink FM/DAB/TV Transmitter 安全漏洞

The Electrolink FM/DAB/TV Transmitter is a series of transmitters from Electrolink. A security vulnerability exists in the Electrolink FM/DAB/TV Transmitter that originates from an attacker being able to bypass authentication and modify cookies to access hidden pages...

DerbyNet 安全漏洞

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet racerid parameter due to improper validation of user-supplied input by the racer-results.php script. An attacker could use this vulnerability to steal the victim's cookie-based...