CVE-2022-25152

The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...

OIC Exponent CMS Cross-Site Scripting Vulnerability (CNVD-2022-33604)

OIC Exponent CMS is a free, open source PHP-based modular content management system CMS from OIC, Inc. The system supports editing directly in the page and provides user management, site configuration, content editing and other functions. oic Exponent CMS has a cross-site scripting vulnerability,...

Mageia: Security Advisory (MGASA-2015-0133)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-37866 Session is not invalidated on server-side when user logged out of Boards

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization...

Talkyard 代码问题漏洞

Talkyard is an open source structured discussion platform that brings together key features of StackOverflow, Slack, Discourse, Reddit/HackerNews, and Disqus blog comments.Talkyard suffers from a code issue vulnerability that could be exploited by an attacker to reuse an administrator's still val...

CVE-2020-19316

creationtimestamp| type| source ---|---|--- 2021-12-20 22:41:12+00:00| seen| https://t.me/cibsecurity/34296...

phpKF CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution RCE Unauthenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.phpkf.com/ Software Link: https://www.phpkf.com/indirme.php Version: 3.00 Category: Webapps Tested on: Linux/Windows phpKF-CMS; It is a very popula...

CVE-2021-31852

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...

Cross site scripting

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface...

Cross site scripting

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...

CVE-2021-31851

The CVE-2021-31851 entry concerns McAfee Policy Auditor prior to version 6.5.2, which is affected by a Reflected Cross-Site Scripting vulnerability. A remote unauthenticated attacker can inject arbitrary web script or HTML via the profileNodeID parameter; the script is reflected into the Policy A...

CVE-2021-43046 TIBCO PartnerExpress Session Token in URL

The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability...

TIBCO Partnerexpress 加密问题漏洞

TIBCO Partnerexpress is a Php-based platform that generates barcodes by product name from TIBCO USA. A cryptographic issue exists in Tibco PartnerExpress where the product does not encrypt session tokens during interactions. An attacker could obtain the token to simulate an interaction. The...

TIBCO Security Advisory: November 16, 2021 - TIBCO PartnerExpress -2021-43046

TIBCO PartnerExpress Session Token in URL Original release date: November 16, 2021 Lastrevised: CVE-2021-43046 Source: TIBCO SoftwareInc. Products Affected TIBCO PartnerExpress versions 6.2.1 and below The following components are affected: Interior Server Gateway Server Description The component...

TIBCO Security Advisory: November 16, 2021 - TIBCO PartnerExpress -2021-43046

TIBCO PartnerExpress Session Token in URL Original release date: November 16, 2021 Lastrevised: CVE-2021-43046 Source: TIBCO SoftwareInc. Products Affected TIBCO PartnerExpress versions 6.2.1 and below The following components are affected: Interior Server Gateway Server Description The component...

CVE-2019-19810

creationtimestamp| type| source ---|---|--- 2021-10-28 14:17:01+00:00| seen| https://t.me/cibsecurity/31340...

Sensitive Cookie Without 'HttpOnly' Flag in namelessmc/nameless

Description Due to a culmination of factors in the design of the authentication and authorization system and a lack of proper cookie setting it is possible for a malicious user to exfiltrate session tokens from a NamelessMC instance and aggregate them in a remote service. A malicious administrati...

Cross-site Scripting (XSS) - Stored in osticket/osticket

Description As it is written on github profile, osTicket is a widely-used open source support ticket system. During source code research I discovered bad uploaded file type check, which is controlled by user. Unauthenticated user can upload malicious html/js file. FROM OWASP:: Cross-Site Scriptin...

The vulnerability of the management tool for virtual infrastructure, VMware vCenter Server, is related to insufficient verification of session tokens. This allows attackers to increase their privileges.

The vulnerability of the management tool for virtual infrastructure, VMware vCenter Server, is related to insufficient verification of session tokens. Exploiting this vulnerability can allow attackers to increase their privileges...

Wire-server code issue vulnerability

Wire-server is a backup server for the open source Wire secure messaging application. Wire-server has a security vulnerability that could be exploited to trigger a user's email address change using only a short-term session token in the "Authorization" header...