6626 matches found
CVE-2023-39423 Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll
The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user...
ROS-20230905-02
Vulnerability in the ksmbd module of Linux kernel operating systems is related to synchronization errors when using a shared resource. synchronization errors when using a shared resource. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code using the...
The Hidden Dangers of Public Wi-Fi
Public Wi-Fi, which has long since become the norm, poses threats to not only individual users but also businesses. With the rise of remote work, people can now work from virtually anywhere: a cafe close to home, a hotel in a different city, or even while waiting for a plane at the airport. Next,...
Cross site scripting
Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...
PT-2023-19661 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to v767 Description: The issue is related to a Cross-site Scripting XSS vulnerability in the Visual Console Module of Pandora FMS. This vulnerability could be used to hijack admin users' session cookie values and...
CVE-2023-40024 Reflected Cross-Site Scripting (XSS) in scancode.io license endpoint
ScanCode.io is a server to script and automate software composition analysis pipelines. In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting XSS vulnerability when attempting to access a detailed license vie...
PT-2023-5949
Name of the Vulnerable Software and Affected Versions ScanCode.io versions prior to 32.5.2 Description The issue arises from inadequate validation and sanitization of the key parameter in the /license/ endpoint, specifically in the license details view function. This can result in a potential...
Default credentials
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully steali...
CVE-2023-39963
CVE-2023-39963 affects Nextcloud Server: a missing password confirmation after stealing a session can allow an attacker to create app passwords for the victim in listed older branches (versions before patches 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8/9, 24.0.12.5, 25.0.9, 26.0.4, 27.0.1; patch...
PHPJabbers Vacation Rental Script 4.0 - CSRF
Exploit Title: PHPJabbers Vacation Rental Script 4.0 - CSRF Date: 05/08/2023 Exploit Author: Hasan Ali YILDIR Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/vacation-rental-script/ Version: 4.0 Tested on: Windows 10 Pro Description The attacker can send to...
CrushFTP Unauthenticated RCE
This exploit module leverages an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability CVE-2023-43177 to achieve unauthenticated remote code execution. This affects CrushFTP versions prior to 10.5.1. It is possible to set some user's session properties by...
CVE-2023-3373
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections session hijacking ...
CVE-2023-3373
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections session hijacking ...
PHPJabbers Night Club Booking 1.0 - Reflected XSS
Exploit Title: PHPJabbers Night Club Booking 1.0 - Reflected XSS Exploit Author: CraCkEr Date: 21/07/2023 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/night-club-booking-software/ Version: 1.0 Tested on: Windows 10 Pro Impact: Manipulat...
CVE-2023-3373
The CVE-2023-3373 issue affects Mitsubishi Electric GOT2000 GOT2000 GT21 (versions 01.49.000 and earlier) and GOT SIMPLE GS21 (versions 01.49.000 and earlier). The vulnerability arises from a Predictable Exact Value from Previous Values weakness in the FTP server data connection port, enabling a ...
CVE-2023-3373
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections session hijacking ...
CVE-2023-37501
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks...
Cross site scripting
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks...