CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985

In Factor (App Framework & Headless CMS) from v1.0.4 through v1.8.30, the vulnerability stems from improperly invalidating a user session after logout and storing sessions in browser local storage (which has no expiration). This enables an attacker to steal and reuse session data via XSS, potenti...

CVE-2021-25984

CVE-2021-25984 affects Factor (App Framework & Headless CMS) forum plugin, versions v1.3.3–v1.8.30. The root cause is stored XSS in the post reply functionality, allowing unauthenticated attackers to execute malicious JavaScript and steal session cookies. No remediation details are provided in th...

CVE-2021-25984 FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality

In Factor App Framework & Headless CMS forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting XSS at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

CVE-2021-25984

In Factor App Framework & Headless CMS forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting XSS at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

CVE-2021-25983

In Factor App Framework & Headless CMS forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

CVE-2021-25983

CVE-2021-25983 corresponds to a reflected Cross-Site Scripting (XSS) vulnerability in FactorJS’s forum plugin. The affected product is Factor (App Framework & Headless CMS) with the forum plugin versions v1.3.8 to v1.8.30. The underlying issue is XSS in the URL parameters “tags” and “category,” a...

CVE-2021-25982 FactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality

In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

CVE-2021-25982

In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

CVE-2021-25982

CVE-2021-25982 affects FactorJS - Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30. The flaw is a reflected Cross-Site Scripting (XSS) vulnerability in the URL’s search parameter, allowing an unauthenticated attacker to inject and execute JavaScript and potentially ste...

SharkBot — A New Android Trojan Stealing Banking and Cryptocurrency Accounts

Cybersecurity researchers on Monday took the wraps off a new Android trojan that takes advantage of accessibility features on mobile devices to siphon credentials from banking and cryptocurrency services in Italy, the U.K., and the U.S. Dubbed "SharkBot" by Cleafy, the malware is designed to stri...

CVE-2021-25985: Insufficient Session Expiration

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

Darwin Factor code issue vulnerability

Darwin Factor is a free and open source next-generation TypeScript framework from Darwin, Inc. It is used to create blogs, login pages, and JamStack applications. Darwin Factor has a security vulnerability that stems from incorrectly invalidating a user's session even after the user logs out of t...

PT-2021-16905

Name of the Vulnerable Software and Affected Versions Factor App Framework & Headless CMS forum plugin versions 1.3.5 through 1.8.30 Description The issue allows an unauthenticated attacker to execute malicious JavaScript code and steal session cookies through reflected Cross-Site Scripting XSS a...

CVE-2021-25982: Improper Neutralization of Input During Web Page Generation

In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Darwin Factor Cross-Site Script Vulnerabilities

Darwin Factor is a free and open source next-generation TypeScript framework from Darwin, Inc. Darwin Factor has a cross-site scripting vulnerability that stems from vulnerability to search parameter reflection cross-site scripting XSS attacks in URLs, which can be exploited by unauthenticated...

PT-2021-16906

Name of the Vulnerable Software and Affected Versions Factor App Framework & Headless CMS forum plugin versions v1.3.8 through v1.8.30 Description The issue allows an unauthenticated attacker to execute malicious JavaScript code due to reflected Cross-Site Scripting XSS at the tags and category...

PT-2021-16908

Name of the Vulnerable Software and Affected Versions Factor App Framework & Headless CMS versions 1.0.4 through 1.8.30 Description The issue arises from improper session invalidation after a user logs out, combined with the storage of user sessions in the browser's local storage, which lacks an...

CVE-2021-25984: Improper Neutralization of Input During Web Page Generation

In Factor App Framework & Headless CMS forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting XSS at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

PT-2021-16907

Name of the Vulnerable Software and Affected Versions Factor App Framework & Headless CMS forum plugin versions v1.3.3 through v1.8.30 Description The issue allows an unauthenticated attacker to execute malicious JavaScript code and steal session cookies due to stored Cross-Site Scripting XSS at...