Cross-Site Request Forgery (CSRF)

openmage/magento-lts is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the resetPasswordPostAction function in AccountController.php because the user sessions are not properly managed which allows an attacker to change a user passwords...

CVE-2022-34451

PowerPath Management Appliance with versions 3.3 & 3.2, 3.1 & 3.0 contains a Stored Cross-site Scripting Vulnerability. An authenticated admin user could potentially exploit this vulnerability, to hijack user sessions or trick a victim application user into unknowingly send arbitrary requests to...

CVE-2022-34451

PowerPath Management Appliance with versions 3.3 & 3.2, 3.1 & 3.0 contains a Stored Cross-site Scripting Vulnerability. An authenticated admin user could potentially exploit this vulnerability, to hijack user sessions or trick a victim application user into unknowingly send arbitrary requests to...

TRENDnet TEW-652BRP Cross-Site Scripting Vulnerability

TRENDnet TEW-652BRP is a wireless router from TRENDnet USA. TRENDnet TEW-652BRP getset.ccp suffers from a cross-site scripting vulnerability, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can obtain sensitive information or hijack user...

PT-2023-15590

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.97 Description A cross-site scripting XSS issue was found in the component /file manage view.php?fmdo=edit&filename. This issue can potentially allow attackers to inject malicious scripts into websites, affecting user...

CVE-2023-24494

A stored cross-site scripting XSS vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user...

CVE-2021-29368

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

Session fixation

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CuppaCMS 授权问题漏洞

CuppaCMS is a content management system CMS. A security vulnerability exists in CuppaCMS that stems from the presence of a session fixation vulnerability, which can be exploited by an attacker to access arbitrary user sessions...

CVE-2021-29368

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CVE-2021-29368: Session Fixation

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CVE-2021-29368

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CVE-2021-29368

CVE-2021-29368 affects CuppaCMS with a session fixation flaw that allows an attacker to access arbitrary user sessions. Affected are versions prior to the commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 (Nov 12, 2019). Root cause is session handling that permits fixation, enabling unauthorized se...

PT-2022-24784 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the offline access scope in Keycloak, affecting users of shared computers more, especially if cookies are not cleared. This issue is due to a lack of root session...

Insecure Session Management

IBM MQ is vulnerable to insecure session management. The vulnerability exists because the sessions are not properly terminated after logout which allows an attacker to get access to the user sessions of other users...

PT-2022-10758

Name of the Vulnerable Software and Affected Versions SEMCMS SHOP version 1.1 Description The issue is related to Cross Site Scripting XSS via the Ant M Coup.php file. This means an attacker could potentially inject malicious scripts into the website, affecting user sessions. Recommendations For...

Insecure Session Management

rdiffweb is vulnerable to insecure session management. The vulnerability exists because user sessions are not properly defined with session persistent timeout which allows an attacker to access the active sessions of other users and perform unauthorized actions...

PT-2022-22595 · Unknown · Dgiot Lightweight Industrial Iot

Name of the Vulnerable Software and Affected Versions: DGIOT Lightweight industrial IoT version 4.5.4 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website,...

PT-2022-25617 · Etap · Etap Safety Manager

Name of the Vulnerable Software and Affected Versions: ETAP Safety Manager version 1.0.0.32 Description: The issue concerns a Cross Site Scripting XSS problem. Input passed to the GET parameter action is not properly sanitized before being returned to the user. This can be exploited to execute...

Insufficient Session Expiration

Description Active user sessions are not invalidated when that user is disabled. Proof of Concept Steps to reproduce: 1. Log in with an admin account. 2. Create a test user with the user role Normal & enable that user 3. Log in with the test user in a separate browser or private browser window 4...