18972 matches found
CVE-2023-0119
CVE-2023-0119 is a stored cross-site scripting vulnerability affecting Foreman as used in Red Hat Satellite. The issue arises from incorrect filtering of input data in the Hosts tab comment section, enabling an attacker with an existing account to steal another user’s session, perform actions on ...
CVE-2023-40732
A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...
CVE-2023-40732
A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...
Design/Logic Flaw
A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...
CVE-2023-40732
A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...
CVE-2023-40732
A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...
CVE-2023-40732
CVE-2023-40732 affects Siemens QMS Automotive: the QMS.Mobile module does not invalidate the session token on logout for all versions before V12.39, enabling potential session hijacking. Impact is limited to user sessions; CVSS v3.1 base score 3.9 (LOW). Remediation per sources: update to V12.39 ...
PT-2023-5721 · Unknown · Hiviewtunner
Name of the Vulnerable Software and Affected Versions: HiviewTunner module affected versions not specified Description: The issue is related to defects introduced in the design process of the HiviewTunner module, which can be exploited to cause service hijacking. This may allow a remote attacker ...
Siemens QMS Automotive 代码问题漏洞
Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. A code issue vulnerability exists in Siemens QMS Automotive, which stems from the affected application's QMS.Mobile module not invalidating session tokens upon logout. An attacker could exploi...
PT-2023-5189 · Unknown · Qms Automotive
Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the QMS.Mobile module of the QMS Automotive software, which does not properly invalidate session tokens upon logout. This could allow an attacker to perform session...
Vietnamese Hackers Deploy Python-Based Stealer via Facebook Messenger
A new phishing attack is leveraging Facebook Messenger to propagate messages with malicious attachments from a "swarm of fake and hijacked personal accounts" with the ultimate goal of taking over the targets' Business accounts. "Originating yet again from a Vietnamese-based group, this campaign...
Cisco HyperFlex HX Data Platform Input Validation Error Vulnerability
The Cisco HyperFlex HX Data Platform is a high-performance, scalable distributed file system that supports a wide range of virtual machine monitoring programs and provides a range of enterprise-class data management and optimization services. An input validation error vulnerability exists in Cisc...
Exploit for Uncontrolled Search Path Element in Cisco Anyconnect_Secure_Mobility_Client
CVE-2021-1366 Cisco AnyConnect Posture HostScan Local Privil...
Code injection
The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user...
CVE-2023-39423 Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll
The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user...
PT-2023-25852 · Atera · Atera
Name of the Vulnerable Software and Affected Versions: Atera affected versions not specified Description: The issue arises from the C:WindowsTempAgent.Package.AvailabilityAgent.Package.Availability.exe file being automatically launched as SYSTEM when the system reboots. Since the...
Oracle Linux 7 : grub2 (ELSA-2020-5790)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5790 advisory. - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 Orabug: 31225072...
CVE-2023-30730
Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android 12, and 13.0.01.43, 13.1.00.83 in Android 13 allows local attacker to access specific file...
CVE-2023-30730
Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android 12, and 13.0.01.43, 13.1.00.83 in Android 13 allows local attacker to access specific file...