348 matches found
CVE-2022-35497
In Trimble's TM4WEB =22.2.0 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint. Specifically, the three cookies used for maintaining sessions are UID, rstring...
CVE-2022-35499
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...
CVE-2022-35497
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...
CVE-2022-35499
Trimble TM4WEB (versions up to 22.2.0 ) is vulnerable to reflected cross-site scripting (XSS) in the external bill viewer endpoint (external_bill_viewer.msw), where an arbitrary parameter appended to the URL is reflected unsanitized into JavaScript in the HTTP response. A proof-of-concept is publ...
EUVD-2022-56032
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...
CVE-2022-35497
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...
CVE-2022-35497
Trimble TM4WEB (≤22.2.0) is vulnerable to session cookie hijacking via the external document viewer endpoint. Three session cookies — UID , rstring , and PHPSESSIONID — lack the HttpOnly flag, allowing their recovery through reflected cross-site scripting (linked to CVE-2022-35499). An attacker c...
CVE-2022-35499
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...
EUVD-2022-56031
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...
CVE-2025-15062
Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a...
CVE-2025-15062 Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a...
CVE-2025-60749
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchupwebhelper.exe...
EUVD-2025-37354
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchupwebhelper.exe...
CVE-2025-60749
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchupwebhelper.exe...
PT-2025-44631
Name of the Vulnerable Software and Affected Versions Trimble SketchUp desktop version 2025 Description A DLL hijacking issue exists in Trimble SketchUp desktop 2025. This occurs due to a crafted libcef.dll file being used by sketchup webhelper.exe. An attacker could potentially leverage this to...
CVE-2025-60749
Trimble SketchUp Desktop 2025 is affected by a DLL hijacking flaw in sketchup_webhelper.exe via a crafted libcef.dll. Root cause: hijacked DLL loading in SketchUp, allowing code execution within the app context (per PT-2025-44631). Affected component/file: libcef.dll used by sketchup_webhelper.ex...
CVE-2025-60749
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchupwebhelper.exe...
EUVD-2013-5868
Malware in sbrugna...