PT-2024-20154 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported, resulting from insufficient encoding of user-controlled inputs. This can be exploited via the /cupseasylive/countrymodify.php endpoint...

CVE-2024-23855

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxcodemodify.php, in multiple parameters. Exploitation of this vulnerability coul...

Cross site scripting

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxcodemodify.php, in multiple parameters. Exploitation of this vulnerability coul...

CVE-2024-23855 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxcodemodify.php, in multiple parameters. Exploitation of this vulnerability coul...

CVE-2024-23855 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxcodemodify.php, in multiple parameters. Exploitation of this vulnerability coul...

CVE-2024-23855

CVE-2024-23855 affects Cups Easy (Purchase & Inventory) version 1.0. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient encoding of user-controlled inputs in multiple parameters, reachable via /cupseasylive/taxcodemodify.php. Exploitation could allow an attacker to lure...

Cups Easy Cross-Site Scripting Vulnerability

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. A cross-site scripting vulnerability exists in Cups Easy version 1.0, which stems from insufficiently encoded user-controlled input that results in multiple parameters in...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their...

Cross-Site Request Forgery (CSRF)

pyLoad is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to a missing SameSite attribute for the session cookie. This allows an attacker to perform a Cross-Site Request Forgery CSRF attack via an API call...

CVE-2024-22416 Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

pyLoad is a free and open-source Download Manager written in pure Python. The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery CSRF attac...

CVE-2023-48249

The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users...

The vulnerability of the zbx_session cookie file in the Zabbix monitoring system allows a hacker to increase their privileges.

The vulnerability of the zbxsession cookie file in the Zabbix monitoring system is related to incorrect processing of security prefixes in cookie file names. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

SUSE CVE-2023-32725

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user...

CVE-2023-32725

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user...

CVE-2023-32725

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user...

DEBIAN-CVE-2023-32725

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user...

CVE-2023-32725

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user...

Session fixation

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user...

CVE-2023-32725

The CVE-2023-32725 issue affects the Zabbix frontend URL widget: testing or running scheduled reports can cause the site to receive a session cookie that can be used to access the frontend as the specific user. Root cause is improper handling of session cookies in the URL widget, enabling session...

CVE-2023-32725

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user...