CVE-2024-49705 XSS in iKSORIS

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise DoS attacks. An attacker might trick a user into using an URL with a d parameter set to an unhandled value. All the subsequent requests will not be accepted as the server returns an error...

CVE-2024-49705

Technical details are not publicly provided in the supplied documents. Monitor for updates.

Revive Adserver: Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2

A reflected Cross-Site Scripting XSS vulnerability has been identified in Revive Adserver version 5.5.2. This vulnerability allows an attacker to inject malicious JavaScript code into the application, which is then executed in the context of the victim's browser. The vulnerability is present in t...

PT-2025-16234 · Softcom · Softcom Iksoris Internet Starter

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue allows an attacker with access to a user's browser to set an arbitrary session cookie value, potentially leading to account takeover. The system's failure to destr...

SoftCOM iKSORIS 授权问题漏洞

SoftCOM iKSORIS is an application from SoftCOM, Inc. An authorization issue vulnerability exists in SoftCOM iKSORIS versions prior to 79.0 that stems from allowing arbitrary session cookie values to be set, which could lead to account hijacking...

CVE-2025-30166

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

Pimcore's Admin Classic Bundle allows HTML Injection

Summary An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. Details The vulnerability was discovered in the...

GHSA-X82R-6J37-VRGG Pimcore's Admin Classic Bundle allows HTML Injection

Summary An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. Details The vulnerability was discovered in the...

Internet Bug Bounty: Possible Sensitive Session Information Leak in Active Storage

There was a possible sensitive session information leak in Active Storage. Active Storage incorrectly sent the user's session cookie along with a Cache-Control: public header when serving files blobs. This allowed certain caching proxies to cache the response, including the Set-Cookie header,...

CVE-2025-30166

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166

CVE-2025-30166 affects Pimcore’s Admin Classic Bundle. An HTML injection vulnerability resides in the /admin/email/send-test-email endpoint’s content parameter, allowing authenticated users with email-sending access to inject HTML into emails, potentially leaking session cookies or altering page ...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

The vulnerability of the Eltex NTU-RG-5420G-Wac router’s microprogramming software lies in the fact that the operation of writing data beyond the buffer in memory occurs when processing the value of the "_session" parameter in the cookie header. This allows a hacker to cause a service failure.

The vulnerability of the Eltex NTU-RG-5420G-Wac router’s microprogramming software lies in the fact that the operation exceeds the buffer boundaries in memory when processing the value of the "session" parameter in the cookie header. Exploiting this vulnerability allows a remote attacker to cause...

CVE-2025-2859

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...

Arteche saTECH BCU 授权问题漏洞

The Arteche saTECH BCU is a flight room control unit from Arteche. An authorization issue vulnerability exists in the Arteche saTECH BCU version 2.1.3, which originates from an attacker being able to capture traffic and obtain a user cookie to steal active sessions and change the device based on...

CVE-2024-7053

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

CVE-2024-7053

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

CVE-2024-7053

CVE-2024-7053 affects open-webui/open-webui version 0.3.8. A session-fixation vulnerability allows a user-level attacker to cause the administrator’s session cookie to be exfiltrated via a cross-origin request triggered by a malicious markdown image in chat. The cookies use SameSite=Lax and lack ...

PT-2025-12183

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A vulnerability allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secu...