L00Neyhacker

The issue is related to the lack of enforcement of HSTS headers. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows the cookie to be stolen via unencrypted traffic.

The issue concerns Cross-origin resource sharing (CORS), which is a security feature that restricts web pages from making requests to a different origin (domain, protocol, or port) than the one the web page was loaded from. This helps prevent malicious scripts from making unauthorized requests on behalf of the user. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue allows the login screen to be iframed, potentially manipulating users into performing unintended actions. The vendor claims that a Content-Security-Policy HTTP response header is present to block this attack.

The issue concerns Cross Origin Resource Sharing (CORS) in Connectwise Control. According to the vendor, two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and they claim there is no risk from this behavior. The vulnerability report is disputed.

The issue concerns cleartext authentication, where authentication is performed via HTTP with SSL disabled. This is reportedly controlled by a configuration option, allowing customers to choose HTTP over HTTPS during troubleshooting. The vendor considers this behavior to be by design.

The login page of Connectwise Control does not implement HSTS headers, which results in not enforcing HTTPS. The vendor's position is that this behavior is controlled by a configuration option, allowing customers to choose HTTP over HTTPS during troubleshooting.

The issue concerns the disclosure of sensitive keys. Specifically, the application reveals hardcoded API keys.

The issue concerns Insecure App Transport Security (ATS) Settings in the Selfwealth iOS mobile App. This means the app may not properly secure its communication, potentially allowing for interception or eavesdropping of sensitive data.

The issue arises when a cookie is issued by the application without having the HttpOnly flag set. This flag is crucial as it helps mitigate the risk of client-side script accessing the cookie, thereby reducing the risk of session hijacking.

The issue arises when the application issues a cookie without setting the secure flag.

An issue was discovered in the web application where it accepts and reflects arbitrary domains supplied via a client-controlled `Host` header. Injection of a malicious URL in the `Host` header of the HTTP Request results in a 302 redirect to an attacker-controlled page.

An issue was discovered in the web application of Cherwell Service Management, where XSS can occur via a payload in the `SAMLResponse` parameter of the HTTP request body.

An issue was discovered in the web application where injection of a malicious payload within the `RelayState=` parameter of the HTTP request body results in the hijacking of the form action. This occurs when the application places user-supplied input into the action URL of an HTML form. An attacker can use this to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.

An issue was discovered in the web application where the `ASP.NET Sessionid` cookie is not protected by the Secure flag, making it prone to interception by an attacker if traffic is sent over unencrypted channels.

The issue allows an attacker to upload a remote shell, such as an aspx file, to the server. The uploaded files are stored in the /Content/Template/root/ directory, for example, reverse-shell.aspx. An attacker can trigger the uploaded shell by simply browsing to its URL, potentially leading to a reverse shell from the victim server.

The issue allows for insecure file upload, enabling the upload of any file extension to the server. The server fails to verify the file extension, which was demonstrated by successfully uploading an aspx file.

Name of the Vulnerable Software and Affected Versions: CS-Cart version 4.11.1 Description: The issue allows for copy-paste XSS by manipulating the `post description` field in the blog post creation page. Recommendations: For CS-Cart version 4.11.1, consider restricting access to the blog post creation page until a fix is available, and avoid manipulating the `post description` field to minimize the risk of exploitation.

The issue concerns mishandling of DNS requests for the hostname in the HTTP Host header. This can be exploited by submitting 127.0.0.1 multiple times, leading to a denial-of-service (DoS) condition.

The issue allows users to upload malicious executable files that might later be downloaded and run by any client user.