1676 matches found
CVE-2021-36205: Incomplete Cleanup
Under certain circumstances the session token is not cleared on logout...
CVE-2021-36205
Under certain circumstances the session token is not cleared on logout...
PT-2022-2699
Name of the Vulnerable Software and Affected Versions Metasys Application and Data Server ADS affected versions not specified Metasys Extended Application and Data Server ADX affected versions not specified Metasys Open Application Server OAS affected versions not specified Description The issue ...
Johnson Controls Metasys
1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely Vendor: Johnson Controls Inc. Equipment: Metasys ADS/ADX/OAS Servers Vulnerability: Incomplete Cleanup 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to use a session token that has...
CVE-2021-46010
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSIONID is predictable. An attacker can hijack a valid session and conduct further malicious operations...
CVE-2022-25152
The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...
OIC Exponent CMS Cross-Site Scripting Vulnerability (CNVD-2022-33604)
OIC Exponent CMS is a free, open source PHP-based modular content management system CMS from OIC, Inc. The system supports editing directly in the page and provides user management, site configuration, content editing and other functions. oic Exponent CMS has a cross-site scripting vulnerability,...
Mageia: Security Advisory (MGASA-2015-0133)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-37866 Session is not invalidated on server-side when user logged out of Boards
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization...
PT-2022-10683
Name of the Vulnerable Software and Affected Versions Mattermost Boards plugin versions 0.10.0 and earlier Description The issue allows an attacker to reuse an old session token for authorization because the session is not properly invalidated on the server-side when a user logs out of Boards...
CVE-2021-25981
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attack...
CVE-2021-25981: Insufficient Session Expiration
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attack...
Talkyard 代码问题漏洞
Talkyard is an open source structured discussion platform that brings together key features of StackOverflow, Slack, Discourse, Reddit/HackerNews, and Disqus blog comments.Talkyard suffers from a code issue vulnerability that could be exploited by an attacker to reuse an administrator's still val...
PT-2022-9686
Name of the Vulnerable Software and Affected Versions Talkyard versions v0.2021.20 through v0.2021.33 Talkyard dev versions v0.2021.20 through v0.2021.34 Description The issue is related to Insufficient Session Expiration, which may allow an attacker to reuse the admin's still-valid session token...
CVE-2020-19316
creationtimestamp| type| source ---|---|--- 2021-12-20 22:41:12+00:00| seen| https://t.me/cibsecurity/34296...
phpKF CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated) Exploit
Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution RCE Unauthenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.phpkf.com/ Software Link: https://www.phpkf.com/indirme.php Version: 3.00 Category: Webapps Tested on: Linux/Windows phpKF-CMS; It is a very popula...
CVE-2021-43817
Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts insid...
CVE-2021-31851
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface...
CVE-2021-31852
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...
Cross site scripting
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface...