CVE-2021-37840

CVE-2021-37840 affects aaPanel up to version 6.8.12, enabling Cross-Site WebSocket Hijacking (CSWH) that can execute OS commands within WebSocket messages issued to ws://…/webssh. The victim must have Terminal configured with at least one host. Exploitation appears browser-dependent (e.g., feasib...

Cross site scripting

LogRhythm Platform Manager PM 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking CSWH. If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable P...

CVE-2020-25095

CVE-2020-25095 concerns LogRhythm Platform Manager (PM) 7.4.9, where the web interface is vulnerable to CSRF via Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, the attacker can establish a WebSocket from the victim’s client to th...