CVE-2023-41297

CVE-2023-41297 affects Huawei HarmonyOS via flaws introduced in the design process of the HiviewTunner module, with the potential for service hijacking. The primary impact described across sources is that exploitation could hijack services, but explicit exploitation status and real-world exploit ...

CVE-2023-41294

The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services...

CVE-2023-41294

Summary: CVE-2023-41294 is a vulnerability in the Huawei HarmonyOS DP module described as a service hijacking flaw that can impact some Super Device services. The initial CVE notes a network-accessible issue with a critical (CVSS 9.8) impact profile (C, I, A HIGH) and no user interaction required...

CVE-2023-41294

The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services...

PT-2023-27885 · Dp Module · Dp Module

Name of the Vulnerable Software and Affected Versions: DP module affected versions not specified Description: The DP module has a service hijacking vulnerability. Successful exploitation of this vulnerability may affect some Super Device services. Recommendations: At the moment, there is no...

CVE-2023-43338

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjsgetptr. This vulnerability allows attackers to execute arbitrary code via a crafted input...

Null pointer dereference

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjsgetptr. This vulnerability allows attackers to execute arbitrary code via a crafted input...

Cesanta MJS Buffer Error Vulnerability

Cesanta MJS is an embedded JavaScript engine for C/C++ from Cesanta Ireland. It is designed for microcontrollers with limited resources. The main design goals are a small footprint and simple C/C++ interoperability. A security vulnerability exists in Cesanta MJS version v2.20.0, which originates...

Cross Site Scripting (XSS)

librenms/librenms is vulnerable to DOM based Cross Site Scripting XSS. The vulnerability is caused by not sanitizing/escaping HTML special characters in a IPV6/IPV4 search field in includes/html/pages/search/ipv6.inc.php while searching for IPV4/IPv6 addresses. This can result in disclosure of th...

CVE-2023-43338

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjsgetptr. This vulnerability allows attackers to execute arbitrary code via a crafted input...

CVE-2023-43338

CVE-2023-43338 affects Cesanta mjs v2.20.0. A vulnerability in the function mjs_get_ptr() enables function pointer hijacking that can lead to arbitrary code execution via crafted input. CVSS v3.1: Severity CRITICAL (9.8), Network attack vector, no user interaction required. A temporary workaround...

CVE-2023-43338

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjsgetptr. This vulnerability allows attackers to execute arbitrary code via a crafted input...

PT-2023-28786 · Cesanta · Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta mjs version 2.20.0 Description: A function pointer hijacking issue was discovered in the mjs get ptr function, allowing attackers to execute arbitrary code via a crafted input. Recommendations: For version 2.20.0, consider disabling t...

CVE-2023-43338

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjsgetptr. This vulnerability allows attackers to execute arbitrary code via a crafted input...

CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

CVE-2022-3916

CVE-2022-3916 affects Keycloak via the offline_access scope. The flaw arises from missing root-session validation and reuse of session IDs between root and user authentication sessions, enabling an attacker to resolve a user session attached to a previously authenticated user; using the refresh t...

GHSA-3CJH-P6PW-JHV9 Pow Mnesia cache doesn't invalidate all expired keys on startup

Use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all Pow.Store.Backend.MnesiaCache instances have been shut down for a period that is longer than the keys' remaining TTL and...

Pow Mnesia cache doesn't invalidate all expired keys on startup

Use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all Pow.Store.Backend.MnesiaCache instances have been shut down for a period that is longer than the keys' remaining TTL and...

CVE-2023-42446

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

Design/Logic Flaw

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...