NextCloud security vulnerabilities

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from a security vulnerability that stems from the fact that under certain circumstances, a user's password is stored in session data in a...

Remitly: [CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/start

The vulnerability discovered allows an attacker to reset the password of a victim's account without requiring any user interaction or special privileges. By intercepting the password reset request and modifying it with the victim's session data, the attacker can successfully take over the account...

PT-2024-9153 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.12 Nextcloud Server versions prior to 29.0.9 Nextcloud Server versions prior to 30.0.2 Description: The issue concerns the storage of user passwords in unencrypted form in session data under certain...

CVE-2024-10287

Cross-Site Scripting XSS vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user and steal their session details through /mlss/ForgotPassword, parameter ListName...

LocalServer Cross-Site Script Vulnerabilities

LocalServer is a web server software for Windows by murdas83 Individual Developer. A cross-site scripting vulnerability exists in LocalServer version 1.0.9, which stems from a cross-site scripting XSS vulnerability that could allow a remote user to send a specially crafted query to an authenticat...

LocalServer Cross-Site Script Vulnerabilities

LocalServer is a web server software for Windows from the individual developer murdas83. A cross-site scripting vulnerability exists in LocalServer version 1.0.9, which can be exploited to obtain sensitive information from a user session via the to parameter on the /testmail/index.php page...

SOPlanning Cross-Site Scripting Vulnerabilities

SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.45 that stems from improper input validation and allows a remote user to send a specially crafted query to steal session details from...

PT-2024-31479 · Nintendo · Mario Kart 8 Deluxe +1

Name of the Vulnerable Software and Affected Versions: Mario Kart 8 Deluxe versions prior to 3.0.3 Description: The issue is caused by a stack-based buffer overflow in the LAN/LDN local multiplayer implementation, allowing a remote attacker to exploit it upon deserialization of session informatio...

CVE-2024-23586

HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old session information...

PT-2024-19949 · Hcl · Hcl Nomad

Name of the Vulnerable Software and Affected Versions: HCL Nomad affected versions not specified Description: The issue is related to insufficient session expiration, which under certain circumstances could allow an unauthenticated attacker to obtain old session information. Recommendations: At t...

HCL Nomad security vulnerabilities

HCL Nomad is an application for using and managing the Domino application development platform in mobile devices from HCL USA. A security vulnerability exists in HCL Nomad that stems from vulnerability to insufficient session expiration, where an unauthenticated attacker can obtain old session...

PT-2024-31874 · Unknown · Monica Ai Assistant

Name of the Vulnerable Software and Affected Versions: Monica AI Assistant desktop application version 2.3.0 Description: The issue allows an attacker to modify the chatbot's answer with an unloaded image, which can exfiltrate the user's sensitive chat data of the current session to a malicious...

CVE-2024-8471

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php...

PT-2024-39038 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal versions affected versions not specified Description: A Cross-Site Scripting XSS issue exists due to insufficient encryption of user-controlled input. This could allow an attacker to retrieve the session details of an authenticated...

CVE-2024-33994

Cross-Site Scripting XSS vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in '/event/index.php'...

CVE-2024-33993

Cross-Site Scripting XSS vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in /candidate/index.php'...

PT-2024-25625 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Event Management System version 1.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the view...

School Event Management System Cross-site Scripting Vulnerabilities

School Event Management System is a school event management system. A cross-site scripting vulnerability exists in School Event Management System version 1.0. An attacker can create a specially crafted URL and send it to a victim to obtain their session details via the "view" parameter in...

Zoho ManageEngine ADAudit Plus Access Control Disclosure

The vulnerability of the Windows Active Directory AD management and reporting software Zoho ManageEngine ADAudit Plus is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to view data recorded by other users’ sessions...

GNOME Remote Desktop Remote Access Unauthorized Access

The vulnerability of the GNOME Remote Desktop remote connection package lies in the provision of a data element for erroneous sessions. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...