18985 matches found
PT-2023-23017 · Avideo · Avideo
Name of the Vulnerable Software and Affected Versions: AVideo versions prior to 12.4 Description: The issue arises from the failure to properly sanitize malicious characters when creating a Meeting Room in AVideo, allowing an attacker to insert malicious scripts. This can lead to cookie hijacking...
CVE-2023-30856
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...
Cross site scripting
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...
CVE-2023-30856
eDEX-UI (versions ≤2.2.8) is affected by CVE-2023-30856 due to cross-site WebSocket hijacking that enables remote command execution. Root cause: lack of origin validation in the internal WebSocket server. Vulnerable code location: edex-ui/src/classes/terminal.class.js:458. A community patch propo...
CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...
CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...
CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...
eDEX-UI 访问控制错误漏洞
eDEX-UI is a full-screen, cross-platform terminal emulator and system monitor from the individual developer Gabriel Saillard in France. A security vulnerability exists in eDEX-UI version 2.2.8 and prior versions, which stems from vulnerability to cross-site web hijacking, where a malicious websit...
PT-2023-23012
Name of the Vulnerable Software and Affected Versions eDEX-UI versions 2.2.8 and prior Description eDEX-UI is a science fiction terminal emulator that is vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal...
OffchainDNSResolver Contract Missing onlyOwner Modifier in Constructor Can Lead to DNS Hijacking Attacks
Lines of code Vulnerability details Impact The OffchainDNSResolver contract has a security vulnerability where it doesn't have a safeguard called the onlyOwner modifier in its constructor, this means that anyone can deploy the contract. This could allow a bad actor to create a version of the...
CVE-2023-2355
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3900...
CVE-2023-2355
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3900...
Privilege escalation
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3900...
CVE-2023-2355
CVE-2023-2355 affects Acronis Snap Deploy on Windows prior to build 3900. The vulnerability is a DLL hijacking local privilege escalation that can grant high confidentiality/integrity/availability impact; root cause is DLL hijack in the deployment component. Mitigation: apply build 3900 or later ...
CVE-2023-2355
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3900...
CVE-2023-2355
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3900...
XML.php JSONP hijacking
Description The XML.php file has a JSONP hijacking vulnerability. When a user visits a page carefully crafted by the attacker, the JSON data is obtained and sent to the attacker. Proof of Concept We created an HTML file as a proof of concept to showcase the vulnerability. This HTML file will...
CVE-2022-47758
Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack...