18910 matches found
Teltonika Remote Management System 安全漏洞
Teltonika Remote Management System is a remote management system used by Teltonika to manage Teltonika products. A security vulnerability exists in Teltonika Remote Management System versions prior to 5.7, which stems from misuse of the invite feature and could lead to account pre-hijacking...
Information exposure in Next.js dev server due to lack of origin verification
Summary A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a...
From Infection to Access: A 24-Hour Timeline of a Modern Stealer Campaign
Stealer malware no longer just steals passwords. In 2025, it steals live sessions—and attackers are moving faster and more efficiently than ever. While many associate account takeovers with personal services, the real threat is unfolding in the enterprise. Flare's latest research, The Account and...
How 'Browser-in-the-Middle' Attacks Steal Sessions in Seconds
Would you expect an end user to log on to a cybercriminal's computer, open their browser, and type in their usernames and passwords? Hopefully not! But that's essentially what happens if they fall victim to a Browser-in-the-Middle BitM attack. Like Man-in-the-Middle MitM attacks, BiTM sees...
Unspecified Vulnerability in Gnu Screen
Gnu Screen is an application from the American GNU community. It provides the effect of getting multiple virtual terminals on one physical terminal. Gnu Screen suffers from a security vulnerability that stems from TTY hijacking, but no details of the vulnerability are available at this time...
CVE-2025-46802 Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen
For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session...
CVE-2025-46802
For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session...
CVE-2025-46802 Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen
For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session...
CVE-2025-46802
CVE-2025-46802 affects the GNU Screen package. The issue allows a local attacker to hijack a TTY by briefly setting the PTY to mode 666, enabling connection to a screen session. A patch is available in the Screen project (commit id 049b26b22e197ba3be9c46e5c193032e01a4724a) and several distributio...
CVE-2025-48368
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting XSS vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim'...
CVE-2025-2272
Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05...
CVE-2025-24829
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 39378...
CVE-2025-24828
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 39378...
CVE-2025-24830
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 39378...
CVE-2025-24827
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 39378...
CVE-2025-22387
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...
CVE-2024-49391
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files Windows before build 9.0.0x24...
CVE-2024-47945
The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions...
CVE-2024-45803
Wire UI is a library of components and resources to empower Laravel and Livewire application development. A potential Cross-Site Scripting XSS vulnerability has been identified in the /wireui/button endpoint, specifically through the label query parameter. Malicious actors could exploit this...