One Identity Safeguard for Privileged Sessions 安全漏洞

One Identity Safeguard for Privileged Sessions is a platform from US-based One Identity, Inc. stores and manages sensitive credentials such as passwords, keys and other keys in a centralized, hardened vault. A security vulnerability exists in One Identity Safeguard for Privileged Sessions prior t...

CVE-2024-40595

One Identity Safeguard for Privileged Sessions (SPS) On Premise prior to 7.5.1 (and LTS prior to 7.0.5.1) contains an authentication-bypass in the RDP component that could let an MITM attacker access privileged sessions by intercepting cleartext RDP traffic. Affected component/file is the SPS RDP...

WordPress plugin WP Sessions Time Monitoring Full Automatic SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

CVE-2024-40595

An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions SPS On Premise before 7.5.1 and LTS before 7.0.5.1 allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol informatio...

Umbraco CMS 授权问题漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. An authorization issue vulnerability exists in Umbraco CMS that stems from a server session not being fully terminated during an explicit logout...

CVE-2024-8901 Lack of JWT issuer and signer validation

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin WP Sessions Time Monitoring Full Automatic versions = 1.0.9...

PT-2024-33634 · Unknown · Swit Wp Sessions Time Monitoring Full Automatic

Name of the Vulnerable Software and Affected Versions: SWIT WP Sessions Time Monitoring Full Automatic versions 1.0.9 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

CVE-2024-10033

A vulnerability was found in aap-gateway. A Cross-site Scripting XSS vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions a...

CVE-2024-10033

CVE-2024-10033 is an XSS vulnerability in the aap-gateway component of Red Hat Ansible Automation Platform (automation-gateway). The associated Red Hat advisory RHSA-2024:8534 lists this issue among security fixes and notes an upgrade path for the platform (automation-gateway updated to 2.5.3). T...

CVE-2024-45462

The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out...

SAP Commerce Backoffice Cross-Site Scripting Vulnerability

SAP Commerce Backoffice is a powerful tool for managing and maintaining e-commerce websites, allowing administrators and operations teams to easily manage website content and configuration. SAP Commerce Backoffice suffers from a cross-site scripting vulnerability that can be exploited by remote...

SAP NetWeaver Enterprise Portal Cross-Site Scripting Vulnerability (CNVD-2024-49627)

Backoffice for SAP Commerce Cloud is a user-centered, scalable back-end interface that allows business users to easily manage any type of data in SAP Commerce Cloud. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which can be exploited by remote attackers to injec...

CVE-2024-47502

An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service DoS. In specific cases the state of TCP sessions that are terminated is not cleared, which over...

CVE-2024-47502

An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service DoS. In specific cases the state of TCP sessions that are terminated is not cleared, which over...

CVE-2024-47502 Junos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS

An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service DoS. In specific cases the state of TCP sessions that are terminated is not cleared, which over...

CVE-2024-47502

CVE-2024-47502 affects Juniper Networks Junos OS Evolved. The issue is an Allocation of Resources Without Limits or Throttling in the kernel that can allow an unauthenticated, network-based attacker to trigger a DoS. In IPv4-only scenarios, TCP sessions terminated on the Routing Engine may not ha...

PT-2024-39852 · Craig Rodway · Classroombookings

Name of the Vulnerable Software and Affected Versions: Craig Rodway Classroombookings version 2.8.7 Description: A vulnerability was found in the processing of the file /sessions of the component Session Page. The manipulation of the argument Name leads to cross site scripting. The attack may be...

CVE-2024-47828 Cross-Site Request Forgery in ampache

ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects Playlist, smartlist etc.. Cross-Site Request Forgery CSRF is an attack that forces authenticated users to submit a request to a Web application against which they a...

CVE-2024-47828 Cross-Site Request Forgery in ampache

ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects Playlist, smartlist etc.. Cross-Site Request Forgery CSRF is an attack that forces authenticated users to submit a request to a Web application against which they a...