Design/Logic Flaw

Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cooki...

CVE-2023-25569

CVE-2023-25569 (Apollo portal) : Prior to version 2.1.0, a low-privileged user can trigger creation of a special web page that an authenticated portal admin might visit, allowing the page to silently issue a request to assign new roles to that user without admin confirmation. This is effectively ...

CVE-2023-25569 apollo-portal has potential CSRF issue

Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cooki...

CVE-2023-25569 apollo-portal has potential CSRF issue

Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cooki...

PT-2023-20167 · Apollo · Apollo

Name of the Vulnerable Software and Affected Versions: Apollo versions prior to 2.1.0 Description: A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmatio...

SUSE CVE-2018-12402

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resource...

SUSE CVE-2018-18351

Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page...

SUSE CVE-2022-45413

Using the S.browserfallbackurl parameter parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.This issue only affects Firefox for Android. Other operating systems are not affected.. This vulnerability affects Firefox 107...

SameSite Attribute vulnerability in pimCore

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

GHSA-R2VQ-P658-P274 SameSite Attribute vulnerability in pimCore

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

CVE-2023-25240

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

Design/Logic Flaw

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

CVE-2023-25240: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

CVE-2023-25240

CVE-2023-25240 concerns pimCore v10.5.15, where an improper SameSite Attribute vulnerability allows attackers to execute arbitrary code. The connected documents confirm the affected software and the underlying issue (SameSite handling) but do not provide a concrete exploitation method, affected c...

CVE-2023-25240

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

CVE-2023-25240

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

CVE-2023-25240

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

CVE-2023-25240

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code...

PT-2023-20000 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimCore version 10.5.15 Description: The issue is related to an improper SameSite Attribute, which allows attackers to execute arbitrary code. Recommendations: For pimCore version 10.5.15, update to a version that fixes the improper SameSite...

pimCore 5.4.18 - PHPSESSID cookie Session Exploit

Title: pimCore-5.4.18-skeleton Sensitive Cookie with Improper SameSite Attribute - PHPSESSID cookie Session vulnerability Author: nu11secur1ty Vendor: https://pimcore.com/en Software: https://packagist.org/packages/pimcore/skeleton Reference:...