Dell iDRAC9 Security Vulnerability

Dell iDRAC9 is a Dell USA Inc. offering provides the entire PowerEdge family of servers with comprehensive, embedded management, automation capabilities. A controller. A security vulnerability exists in Dell iDRAC9 versions prior to 7.00.00.172 that stems from contains a session hijacking...

GO-2024-2532 Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary

Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary...

Security Bulletin: A vulnerability in urllib3 affects Data Replication on Cloud Pak for Data

Summary A vulnerability in the urllib3 package has been addressed. Vulnerability Details CVEID:CVE-2019-11236 DESCRIPTION: Python urllib3 is vulnerable to CRLF injection, caused by improper validation of user-supplied input by the request parameter. By sending a specially-crafted HTTP response...

Session Hijacking

typo3/cms is vulnerable to Session Hijacking. The vulnerability is due to cookies not being hardened to be submitted only via HTTP, which in combination with other vulnerabilities like cross-site scripting can lead to hijacking an active and valid session...

Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting Vulnerability

Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting XSS Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://automad.org Software Link: https://github.com/marcantondahmen/automad Category: Web Application Flat File CMS Version: 2.0.0-alpha.4 Tested on: Docker version...

Session Hijacking

silverstripe/framework is vulnerable to Session Hijacking. The vulnerability is due to a malfunction in the security protection designed to detect changes in the User-Agent header, which allows an attacker to modify the header without invalidating the user session...

PT-2024-4675 · Huawei · Huawei Ws7206-10 +3

Name of the Vulnerable Software and Affected Versions: Huawei home routers affected versions not specified Huawei TC7001-10, WS7200-10, and WS7206-10 affected versions not specified Description: The issue is related to a connection hijacking vulnerability in some Huawei home routers. This...

XMB 1.9.12.06 - Stored XSS Vulnerability

Exploit Title: Persistent XSS in XMB 1.9.12.06 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.xmbforum2.com/ Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip Version: 1.9.12.06 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent stored XSS vulnerabili...

Carbon Forum 5.9.0 - Stored XSS Vulnerability

Exploit Title: Persistent XSS in Carbon Forum 5.9.0 Stored Exploit Author: Chokri Hammedi Vendor Homepage: https://www.94cb.com/ Software Link: https://github.com/lincanbin/Carbon-Forum Version: 5.9.0 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent stored XSS vulnerability was...

XMB 1.9.12.06 - Stored XSS

Exploit Title: Persistent XSS in XMB 1.9.12.06 Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.xmbforum2.com/ Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip Version: 1.9.12.06 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent store...

Carbon Forum 5.9.0 - Stored XSS

Exploit Title: Persistent XSS in Carbon Forum 5.9.0 Stored Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.94cb.com/ Software Link: https://github.com/lincanbin/Carbon-Forum Version: 5.9.0 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent stored XSS...

XMB 1.9.12.06 Cross Site Scripting

Exploit Title: Persistent XSS in XMB 1.9.12.06 Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.xmbforum2.com/ Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip Version: 1.9.12.06 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent store...

Carbon Forum 5.9.0 Cross Site Scripting

Exploit Title: Persistent XSS in Carbon Forum 5.9.0 Stored Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.94cb.com/ Software Link: https://github.com/lincanbin/Carbon-Forum Version: 5.9.0 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent stored XSS...

Cisco Finesse Web Management Interface Cross-Site Request Forgery Vulnerability

Cisco Finesse is the United States Cisco Cisco company's set of call center management software. A cross-site request forgery vulnerability exists in the Cisco Finesse web management interface, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to...

GHSA-F777-F784-36GM TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

CVE-2024-5673 Cross-Site Scripting in PHP File Manager by Dulldusk

Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fmcurrentdir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session...

PHP File Manager security vulnerability

PHP File Manager is a complete file system management tool from the individual developers at Dulldusk. A security vulnerability exists in PHP File Manager version 1.7.8, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to hijack a browser session b...

Cisco Finesse 安全漏洞

Cisco Finesse is the United States Cisco Cisco company's set of call center management software. A cross-site request forgery vulnerability exists in the Cisco Finesse web management interface, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to...

Monstra CMS 3.0.4 - Remote Code Execution Exploit

Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution RCE Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://monstra.org/ Software Link: https://monstra.org/monstra-3.0.4.zip Version: 3.0.4 Tested on: MacOS import requests import random import string import time import re import sys if...