Lightdash 安全漏洞

Lightdash is a visual data analysis tool from Lightdash open source. A security vulnerability exists in Lightdash version 0.1024.6, which stems from a server-side request forgery SSRF issue that could allow a threat participant to obtain a user's session token when the user exports a dashboard th...

CVE-2024-3982

An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator...

CVE-2024-3982

CVE-2024-3982 affects Hitachi Energy MicroSCADA X SYS600. A local attacker could enable the product’s session logging and attempt to hijack an already established session. By default, session logging is disabled and only administrators can enable it. Several connected sources also describe a loca...

CVE-2024-3982

An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator...

CVE-2024-3982

An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator...

Hitachi Energy MicroSCADA X SYS600 安全漏洞

Hitachi Energy MicroSCADA X SYS600 is a SCADA product from Hitachi, Japan. It ensures optimal control and reliable operation of your switching station through seamless integration and connectivity between different devices and systems. A security vulnerability exists in Hitachi Energy MicroSCADA ...

ZZCMS HTTP_REFERER header cross-site scripting vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v2023 and earlier versions, which stems from incorrect HTTPREFERER header handling, and can be exploited by an attacker to execute malicious scripts via specially crafted URLs...

CVE-2024-43009

A reflected cross-site scripting XSS vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTPREFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user...

CVE-2024-43009

A reflected cross-site scripting XSS vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTPREFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user...

ROS-20240816-15

A vulnerability in the PHP programming language interpreter is related to the erroneous handling of cookies due to the replacement of spaces, dots, and open square brackets with underscores. as a result of replacing spaces, periods and open square brackets with underscores. Exploitation...

ZZCMS 安全漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v2023 and earlier versions, which stems from incorrect HTTPREFERER header handling, and can be exploited by an attacker to execute malicious scripts via specially crafted URLs...

CVE-2024-43009

A reflected cross-site scripting XSS vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTPREFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user...

CVE-2024-43009

CVE-2024-43009 is a reflected XSS in ZZCMS 2023 and earlier, where the HTTP_REFERER header value is inserted directly into the HTML response in user/login.php (line 24). This can allow an attacker to execute arbitrary JavaScript in a victim’s browser, potentially enabling session hijacking or def...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

CVE-2024-41475

CVE-2024-41475 affects Gnuboard g6 6.0.7. Vulnerable due to a misconfigured CORS policy that can enable session hijacking, potentially exposing user sessions (high/critical impact per sources). Remediation: fix CORS configuration to properly restrict cross-origin access; consider restricting acce...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

Gnuboard 安全漏洞

Gnuboard is a suite of extensible forum programs from the Gnuboard open source. A security vulnerability exists in Gnuboard g6 version 6.0.7, which stems from a CORS misconfiguration that makes it vulnerable to session hijacking...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

PT-2024-29416 · Gnuboard · Gnuboard

Name of the Vulnerable Software and Affected Versions: Gnuboard g6 version 6.0.7 Description: The issue is related to Session hijacking due to a CORS misconfiguration. This allows for unauthorized access to user sessions. Recommendations: For Gnuboard g6 version 6.0.7, update the CORS configurati...