1101 matches found
CVE-2024-42345
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP2. The affected application does not properly handle user session establishment and invalidation. This could allow a remote attacker to circumvent the additional multi factor authentication for user session...
CVE-2024-42345
CVE-2024-42345 affects SINEMA Remote Connect Server prior to v3.2 SP2. The vulnerability is a session-fixation flaw where improper handling of user session establishment/invalidation could allow a remote attacker to bypass the additional multi-factor authentication for user session establishment....
CVE-2024-42345
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP2. The affected application does not properly handle user session establishment and invalidation. This could allow a remote attacker to circumvent the additional multi factor authentication for user session...
CVE-2024-32006
A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 SP2. The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authentication...
CVE-2024-32006
CVE-2024-32006 affects SINEMA Remote Connect Client (all versions prior to V3.2 SP2). The vulnerability arises because the client does not expire the user session on reboot without logout, which could allow bypass of Multi-Factor Authentication. The CVSS context from NVD/Red Hat/NCSC indicates cr...
CVE-2024-5148 Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and...
CVE-2024-5148 Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and...
Nuuo Central Management Server User Session Token Bruteforce
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'benchmark' class MetasploitModule 'Nuuo Central Management Server User Session Token Bruteforce', 'Description' = %q Nuuo Central Management Server below versio...
Cross Site Scripting
phpoffice/phpspreadsheet is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to insufficient sanitization of spreadsheet styling information by \PhpOffice\PhpSpreadsheet\Writer\Html, which fails to remove or neutralize potentially harmful content before rendering it in HTML. It...
ROS-20240827-06
The vulnerability in the Ruby interpreter is related to improper neutralization of input data during the generation of a of a web page. Exploitation of the vulnerability could allow an attacker acting locally to conduct cross-site scripting Vulnerability in the Active Storage component of the Rub...
Calibre-web 0.6.21 - Stored XSS Vulnerability
Exploit Title: Stored XSS in Calibre-web Exploit Authors: Pentest-Tools.com Catalin Iovita & Alexandru Postolache Vendor Homepage: https://github.com/janeczku/calibre-web/ Version: 0.6.21 - Romesa Tested on: Linux 5.15.0-107, Python 3.10.12, lxml 4.9.4 CVE: CVE-2024-39123 Vulnerability Descriptio...
ManageEngine ADAudit Plus < Build 8003 Multiple Vulnerabilities
The version of ManageEngine ADAudit Plus installed on the remote host is prior to build 8003. It is, therefore, affected by multiple vulnerabilities. - Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option...
GHSA-QM2Q-9F3Q-2VCV Trix has a cross-site Scripting vulnerability on copy & paste
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99. In https://github.com/basecamp/trix/pull/1149, we added sanitation for...
CVE-2024-39809 BIG-IP Next Central Manager vulnerability
The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2024-39809
CVE-2024-39809 affects BIG-IP Next Central Manager. The central manager user session refresh token does not expire after logout, enabling a continued session if cookies are obtained. This is a control-plane issue with high impact (no data-plane exposure). F5's advisory lists vulnerable lineage as...
K000140111: BIG-IP Next Central Manager vulnerability CVE-2024-39809
Security Advisory Description The BIG-IP Next Central Manager user session refresh token does not expire when a user logs out. CVE-2024-39809 Impact An attacker with access to obtain a user's session cookies can continue to use that session to access BIG-IP Next Central Manager and systems manage...
Trix 安全漏洞
Trix is a Basecamp open source rich text editor for everyday writing. A security vulnerability exists in versions prior to Trix 2.1.4 that stems from the presence of cross-site scripting, which allows an attacker to trick a user into copying and pasting malicious code, and then executing arbitrar...
CVE-2024-36035
Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording...
CVE-2024-36035
CVE-2024-36035 affects Zoho ManageEngine ADAudit Plus, prior to build 8003. The issue is an authenticated SQL injection in the user session recording feature. Known impact is high (CVE/NVD metrics show Confidentiality/Integrity/Availability concerns; base score up to 8.8). Remediation is to upgra...