CVE-2023-23326

A Stored Cross-Site Scripting XSS vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an...

Remote Code Execution

github.com/gitpod-io/gitpod is vulnerable to Remote Code Execution. The vulnerability exists due to cross-site WebSocket Hijacking because the Origin header is not restricted which allows an attacker to take over a workspace with stolen credentials or and extract data from a workplace...

CVE-2023-26261

In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15...

Atlassian Confluence < 7.4.10 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.0 prior to 7.12.3. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows allow authenticated local...

Atlassian Confluence 7.1.x < 7.12.3 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.0 prior to 7.12.3. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows allow authenticated local...

Atlassian Jira < 8.5.5 DLL Hijacking

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 8.0.x prior to 8.7.0. It is, therefore, affected by a vulnerability which permits when deployed onto the Windows operating system environment which allows local system attackers who ha...

Debian: Security Advisory (DLA-65-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Atlassian Jira 8.6.0 < 8.7.2 DLL Hijacking

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 8.0.x prior to 8.7.0. It is, therefore, affected by a vulnerability which permits when deployed onto the Windows operating system environment which allows local system attackers who ha...

Security Bulletin: IBM Spectrum Symphony is vulnerable to Host header injection

Summary IBM Spectrum Symphony 7.3.0 can encounter an unauthenticated Host header injection vulnerability. Vulnerability Details CVEID:CVE-2023-24975 DESCRIPTION: IBM Spectrum Symphony is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could...

Protecting Android clipboard content from unintended exposure

Considering mobile users often use the clipboard to copy and paste sensitive information, like passwords or payment information, clipboard contents can be an attractive target for cyberattacks. Leveraging clipboards can enable attackers to collect target information and exfiltrate useful data...

Exploit for Improper Authentication in Redhat Keycloak

PoC for CVE-2023-0264 Keycloak vulnerability that allows ses...

Atlassian Confluence 7.1.x < 7.1.1 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.0.5 or 7.1.x prior to 7.1.1. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows local system attackers who have...

Atlassian Confluence < 7.0.5 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.0.5 or 7.1.x prior to 7.1.1. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows local system attackers who have...

The vulnerability in the implementation of the GOT Mobile function in the software for graphic control panels from Mitsubishi Electric’s GOT2000 series, models GT27 and GT25, as well as the HMI platform GT SoftGOT2000, allows a attacker to carry out a “click hijacking” attack.

The vulnerability of the GOT Mobile function implementation in Mitsubishi Electric’s GOT2000 series graphic control panels, models GT27 and GT25, as well as the HMI platform GT SoftGOT2000, is related to an incorrect limitation on the layers or frames that can be displayed in the user interface...

CVE-2023-0957

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

Cross site scripting

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

CVE-2023-0957

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

CVE-2023-0957

CVE-2023-0957 describes a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in Gitpod versions prior to release-2022.11.2.16. The issue arises because the Origin header is not restricted, allowing an attacker to initiate WebSocket connections to the Gitpod JSONRPC server using a victim’s crede...

CVE-2023-0957

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

CVE-2023-0957

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...