Cisco Small Business 220 Series Smart Switches Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting XSS attac...

Citrix Application Delivery Controller and Citrix Gateway - SAML Configuration Reference Guide

This article is intended for customers who have configured their Citrix ADC or Citrix Gateway as SAML IdP Identity Provider or SAML SP Service Provider or both. If Citrix ADC or Citrix Gateway appliances are not upgraded to the recommended versions and if the SAML configuration is not configured...

Exposed Session Token

Web applications use sessions to retain information about each user, keep track of their activity or define proper access rights and permissions. Each session has an identifier token or ID defined by the application to bind users to their HTTP traffic, being temporarily equivalent to the stronges...

What Is MITM (Man-in-the Middle) Attack❓ Types and detection methods

A man-in-the-middle MitM represents a sort of cyberattack where an intruder covertly taps transmissions connecting two entities to monitor or alter traffic therebetween. Malicious ones may utilize MitM attacks to seize passwords or other sensitive data, snoop on the prey, disrupt connections, or...

Unspecified Vulnerability in Devellion Cubecart

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A security vulnerability exists in Cubecart version 6.4.2, which stems from the...

Devellion Cubecart 授权问题漏洞

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A security vulnerability exists in Cubecart version 6.4.2, which stems from the...

GHSA-465W-GG5P-85C9 Insufficient Session Expiration in Kiali

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the...

UPchieve: Session Hijacking leads to full control of account by attacker

Hi Team , I am Samprit Das MCEH Metaxone Certified Ethical Hacker and a Security Researcher I just checked your website and got a critical vulnerability please read the report carefully. Description:- The Session Hijacking attack consists of the exploitation of the web session control mechanism,...

Debian DLA-2661-1 : jetty9 security update

Several vulnerabilities were discovered in jetty, a Java servlet engine and webserver. An attacker may reveal cryptographic credentials such as passwords to a local user, disclose installation paths, hijack user sessions or tamper with collocated webapps. CVE-2017-9735 Jetty is prone to a timing...

MTN Group: Cross-Site Request Forgery (CSRF) to xss

hello dear support i have found csrf to xss on https://dailydeals.mtn.co.za/index.cfm?GO=DEALS URL:https://dailydeals.mtn.co.za/index.cfm?GO=DEALS URL encoded POST input CFID was set to fbe8c86c-c0b2-4421-8ca2-dcfc14763d6e" HTTP request ============ POST /index.cfm?GO=DEALS HTTP/1.1 Host:...

CVE-2020-21997

Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...

CVE-2020-21997

Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...

Information disclosure

Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...

CVE-2020-21997

Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...

CVE-2020-21997

Smartwares HOME easy

PT-2021-10712 · Smartwares · Smartwares Home Easy

Name of the Vulnerable Software and Affected Versions: Smartwares HOME easy versions prior to 1.0.9 Description: The issue allows for an unauthenticated database backup download and information disclosure. This could lead to the disclosure of sensitive and clear-text information, potentially...

XWiki XSS Vulnerability (GHSA-5c66-v29h-xjh8)

XWiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

CVE-2021-0275

A Cross-site Scripting XSS vulnerability in J-Web on Juniper Networks Junos OS allows an attacker to target another user's session thereby gaining access to the users session. The other user session must be active for the attack to succeed. Once successful, the attacker has the same privileges as...

CVE-2021-0275 Junos OS: J-Web: Cross-site scripting attack allows an attacker to gain control of another users session.

A Cross-site Scripting XSS vulnerability in J-Web on Juniper Networks Junos OS allows an attacker to target another user's session thereby gaining access to the users session. The other user session must be active for the attack to succeed. Once successful, the attacker has the same privileges as...

XSS Cross Site Scripting

Impact It is possible to persistently inject scripts in XWiki. For unregistred users: - By filling simple text fields For registered users: - By filling their personal information - if they have edit rights By filling the values of static lists using App Within Minutes That can lead to user's...