CVE-2018-20816

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with scri...

CVE-2018-1626

CVE-2018-1626 affects IBM Security Privileged Identity Manager Virtual Appliance 2.2.1, arising from a session handling flaw where a session variable is not renewed after authentication, enabling potential session fixation/hijacking via a cookie that could be known to an attacker. The primary pub...

CVE-2018-1658

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6 is vulnerable to HTTP header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrar...

CVE-2018-1658

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6 is vulnerable to HTTP header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrar...

Cross site scripting

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6 is vulnerable to HTTP header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrar...

CVE-2018-1658

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6 is vulnerable to HTTP header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrar...

CVE-2018-1658

CVE-2018-1658 affects IBM Jazz Foundation used by IBM CLM and related Rational products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM) 5.0–6.0.6. Root cause: HTTP header injection due to input validation issues in IBM Jazz Foundation. Impact: remote attacker can persuade a user to visit a craft...

Design/Logic Flaw

The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used, and an attacker's web site is displayed in a WebView with no information about the URL...

CVE-2019-8345

The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used, and an attacker's web site is displayed in a WebView with no information about the URL...

CVE-2019-8345

CVE-2019-8345 affects ES File Explorer File Manager for Android (version 4.1.9.7.4). The Help feature loads content over HTTP, enabling session hijacking by a local-network MITM attacker, who could display an attacker-controlled site in a WebView without URL information. No exploit details or pat...

CVE-2019-8345

The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used, and an attacker's web site is displayed in a WebView with no information about the URL...

GHSA-5Q75-CXCQ-WR26 Cross-site Scripting in jspwiki-war

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

Cross-site Scripting in jspwiki-war

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

Cross site scripting

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

This CVE affects Apache JSPWiki up to version 2.10.5, where a crafted URL could trigger a cross-site scripting (XSS) vulnerability. The described impact is potential session hijacking. The connected documents consistently identify JSPWiki as the affected product and the vulnerability type as XSS,...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

GitLab: Privilege escalation from any user (including external) to gitlab admin when admin impersonates you

Summary: Hey team, I have discovered a way for any logged in user attacker to escalate his privileges to gitlab administrator if the real gitlab administrator impersonates attacker's account. Description: When the gitlab admin impersonates some user, he gets new gitlabsession cookie and then...