CVE-2021-41553

In ARCHIBUS Web Central 21.3.3.815 a version from 2014, the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the...

CVE-2021-41553

In ARCHIBUS Web Central 21.3.3.815 a version from 2014, the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the...

CVE-2021-41553

In ARCHIBUS Web Central 21.3.3.815 a version from 2014, the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the...

Design/Logic Flaw

UNSUPPORTED WHEN ASSIGNED In ARCHIBUS Web Central 21.3.3.815 a version from 2014, the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known,...

CVE-2021-41553

In ARCHIBUS Web Central 21.3.3.815 a version from 2014, the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the...

CVE-2021-41553

In ARCHIBUS Web Central 21.3.3.815 (2014), the Web Application at /archibus/login.axvw assigns a session token that can already be in use by another user. After login, the app does not issue a new token, continuing to use the inserted token as the session identifier. It is also possible to set th...

PT-2021-23327 · Archibus · Archibus Web Central

Name of the Vulnerable Software and Affected Versions: ARCHIBUS Web Central versions 21.3.3.815 and earlier Description: The issue arises from the Web Application in /archibus/login.axvw, where a session token could be assigned that is already in use by another user. This allowed access to the...

ARCHIBUS Web Central 授权问题漏洞

ARCHIBUS Web Central is a web-based web management center for ARCHIBUS that organizes facility and infrastructure management tasks in an intuitive web browser interface. All infrastructure data is stored in a centralized repository so that authorized users from anywhere in the world can enter, ed...

Authentication flaw

Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of a user with only the short-lived session token in the Authorization header. As the short-lived token is only meant as means of...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109

CVE-2021-41109 refers to a vulnerability in Parse Server where, before version 4.10.4, LiveQuery payloads leaked session tokens for users with a LiveQuery subscription on the Parse.User class. The root cause is that LiveQuery payloads included session tokens while regular queries did not. The adv...

ClinicCases Cross-Site Scripting Vulnerability

ClinicCases is an open source case management system designed for law school clinics. A cross-site scripting vulnerability exists in ClinicCases version 7.3.3 that stems from the software's lack of effective validation and filtering of user-submitted parameters. The vulnerability allows an...

ClinicCases Cross-Site Scripting Vulnerability (CNVD-2022-05858)

ClinicCases is an open source case management system designed for law school clinics.A cross-site scripting vulnerability exists in ClinicCases version 7.3.3, which stems from a lack of effective validation and filtering of user-submitted parameters by the software. The vulnerability allows a low...

CVE-2021-38707

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

CVE-2021-38707

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

CVE-2021-38704

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

CVE-2021-38704

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

Cross site scripting

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

Cross site scripting

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

CVE-2021-38704

ClinicCases 7.3.3 is vulnerable to multiple reflected XSS vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript via a crafted URL, potentially leading to account takeover through session token theft. Affected product: ClinicCases 7.3.3. Root cause: insufficient input...