2108 matches found
OS4Ed OpenSIS 跨站脚本漏洞
OS4Ed OpenSIS is OS4Ed's commercial-grade, secure, scalable and intuitive student information system, school management software. With all the functionality to run single or multiple institutions in a single installation, OS4Ed OpenSIS suffers from a cross-site scripting vulnerability that could ...
CVE-2022-24582
Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manageuser from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network...
OIC Exponent CMS 跨站脚本漏洞
OIC Exponent CMS is a free, open source PHP-based modular content management system CMS from OIC, Inc. The system supports editing directly in the page and provides user management, site configuration, content editing and other functions. oic Exponent CMS has a cross-site scripting vulnerability,...
CVE-2021-22820
A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password. Affected Products: EVlink City EVC1S22P4...
Mageia: Security Advisory (MGASA-2020-0252)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-22551
DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...
Cross site request forgery (csrf)
DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...
CVE-2022-22551
CVE-2022-22551 affects Dell EMC AppSync (versions 3.9–4.3). The issue arises from using the GET method with sensitive query strings, enabling an adjacent, unauthenticated attacker to hijack a victim’s session. Connected sources confirm the product, vulnerable component (GET handling of sensitive ...
CVE-2021-40691
A session hijack risk was identified in the Shibboleth authentication plugin...
CVE-2021-40691
CVE-2021-40691 is a session-hijack risk identified in the Shibboleth authentication plugin, reported in the Moodle ecosystem. The base CVSSv3.1 score from NVD is 4.3 (Medium) with Network attack vector, low attack complexity, no privileges required, but user interaction is required and impact is ...
DELL EMC AppSync 授权问题漏洞
DELL EMC AppSync is a replication data management software from Dell USA Inc. A security vulnerability exists in DELL EMC AppSync due to the use of the GET request method with sensitive query strings in DELL EMC AppSync versions 3.9 through 4.3. . An attacker could use this vulnerability to hijac...
CVE-2022-22551
DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...
CVE-2022-0180
Cross-site request forgery CSRF vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page...
UBUNTU-CVE-2022-23133
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can...
CVE-2021-46109
Invalid input sanitizing leads to reflected Cross Site Scripting XSS in ASUS RT-AC52UB1 3.0.0.4.380.10931 can lead to a user session hijack...
CVE-2021-46109
Invalid input sanitizing leads to reflected Cross Site Scripting XSS in ASUS RT-AC52UB1 3.0.0.4.380.10931 can lead to a user session hijack...
CVE-2021-46109
Invalid input sanitizing leads to reflected Cross Site Scripting XSS in ASUS RT-AC52UB1 3.0.0.4.380.10931 can lead to a user session hijack...
Cross site scripting
Invalid input sanitizing leads to reflected Cross Site Scripting XSS in ASUS RT-AC52UB1 3.0.0.4.380.10931 can lead to a user session hijack...
CVE-2021-46109
The CVE-2021-46109 issue concerns the ASUS RT-AC52U_B1 router (firmware 3.0.0.4.380.10931). Affected component: input handling where invalid input sanitizing enables reflected Cross-Site Scripting (XSS). Root cause: inadequate input validation/sanitization leads to a reflected XSS condition that ...