Siemens Scalance X-200 跨站脚本漏洞

The Siemens Scalance X-200 is an industrial-grade Ethernet switch from Siemens Germany. A cross-site scripting vulnerability exists in SCALANCE Switches, which stems from the presence of a cross-site scripting vulnerability that could lead to session hijacking if exploited by an attacker. The...

PT-2022-25429 · Siemens · Scalance Xf204 +21

Name of the Vulnerable Software and Affected Versions: SCALANCE X200-4P IRT versions prior to V5.5.0 SCALANCE X201-3P IRT versions prior to V5.5.0 SCALANCE X201-3P IRT PRO versions prior to V5.5.0 SCALANCE X202-2IRT versions prior to V5.5.0 SCALANCE X202-2P IRT versions prior to V5.5.0 SCALANCE...

CVE-2022-40631

A vulnerability has been identified in SCALANCE X200-4P IRT All versions V5.5.0, SCALANCE X201-3P IRT All versions V5.5.0, SCALANCE X201-3P IRT PRO All versions V5.5.0, SCALANCE X202-2IRT All versions V5.5.0, SCALANCE X202-2P IRT All versions V5.5.0, SCALANCE X202-2P IRT PRO All versions V5.5.0,...

MapTool v1.11.5 - Cross Site Scripting Vulnerabilities

Document Title: =============== MapTool v1.11.5 - Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2319 Release Date: ============= 2022-10-10 Vulnerability Laboratory ID VL-ID: ==================================== 23...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.25

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 7.0.0.25 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-3304 PM54356 DESCRIPTION: WebSphere Application Server could allow a remote attacker to hijack a valid user’s session, caused by an...

AZL-11032 CVE-2022-39227 affecting package python-jwt for versions less than 2.4.0-2

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

CVE-2022-39227

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

Authentication flaw

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

CVE-2022-39227 Python-jwt subject to Authentication Bypass by Spoofing

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

CVE-2022-39227 Python-jwt subject to Authentication Bypass by Spoofing

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

CVE-2022-39227 Python-jwt subject to Authentication Bypass by Spoofing

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

python-jwt 安全漏洞

python-jwt is a Python module for generating and verifying JSON web tokens from the individual developer David Halls. A security vulnerability exists in python-jwt versions prior to 3.3.4 that stems from being affected by spoofing to bypass authentication, which can lead to identity spoofing,...

You can’t stop me. MS Teams session hijacking and bypass

How cleartext session tokens are stored in an unsecured directory that can be stolen and used to impersonate a Teams user. TL;DR Microsoft Teams stores unencrypted session tokens and cached conversations in users’ roaming AppData, which can be used by an attacker to gain access to the victim’s...

PYSEC-2022-282

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

Security Bulletin: Provision to add https and Secure Flag to bayeux_browser cookie for IBM Control Desk.

Summary BAYEUXBROWSER cookie is generated from Cometd Server and it remains live with the session. In older versions of cometd server, BAYEUXBROWSER cookie was neither true for https nor for secure. But in the current version ie. 5.0.3, there is a provision to make the cookie true for https and...

CVE-2022-39207

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same...

Cross site scripting

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same...

CVE-2022-39207

The CVE-2022-39207 issue affects OneDev (Onedev) Build artifacts handling. It allows XSS via artifacts saved during CI/CD, served in the UI context without additional restrictions. The underlying cause is HTML content in artifacts being rendered by browsers, enabling a session-credential theft ri...

CVE-2022-39207 Persistent XSS in OneDev

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same...

CVE-2022-39799

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user...