18923 matches found
CVE-2019-13167
Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions...
CVE-2019-16238
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...
CVE-2019-10077
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking...
CVE-2018-12423
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.powerlevels event in force...
Session Hijacking
typo3/cms is vulnerable to Session Hijacking. The vulnerability is due to insufficient authentication mechanisms where the backend user management interface allowing password changes without requiring the current password, finally allows an attacker with access to an admin session to change...
CVE-2019-5245
HiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing that could execute arbitrary code...
CVE-2017-11748
VIT Spider Player 2.5.3 has an untrusted search path, allowing DLL hijacking via a Trojan horse dwmapi.dll, olepro32.dll, dsound.dll, or AUDIOSES.dll file...
CVE-2017-11749
InternetSoft FTP Commander 8.02 and prior has an untrusted search path, allowing DLL hijacking via a Trojan horse dwmapi.dll file...
CVE-2017-9518
atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails...
CVE-2017-8930
Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...
CVE-2019-8062
Adobe After Effects versions 16 and earlier have an insecure library loading dll hijacking vulnerability. Successful exploitation could lead to arbitrary code execution...
CVE-2019-5539
VMware Workstation 15.x prior to 15.5.1 and Horizon View Agent 7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4 contain a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. Successful exploitation of this issue may allow attackers with normal user privileges to...
CVE-2019-1020010
Misskey before 10.102.4 allows hijacking a user's token...
CVE-2017-7964
Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacking attacks by reconfiguring the built-in dnshijacker process...
CVE-2013-3420
Cross-site request forgery CSRF vulnerability in the web framework on the Cisco Identity Services Engine ISE allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuh25506...
CVE-2019-1010100
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables ALL executables on the web site. The attack vector is: CAPEC-471, CWE-426, CWE-427...
CVE-2011-3381
Cross-site request forgery CSRF vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2014-3860
Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability...