Patchfirst
Patchfirst
T1185Collection

Browser Session Hijacking

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then…

attack.mitre.org ↗
CVEs24
In 4
Reports1

Detections

2 Sigma rules tagged T1185
Browser Session HijackingT11852 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Browser Session Hijacking

24 CVEs, by priority. Each link shows its badge.
  1. CVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
    Synacor · Zimbra Collaborate Suite (ZCS)KEVRansomwarePublic exploitMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    30.9%Top 1.7%
    76.9priority
  2. CVE-2023-34192Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
    Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitCritical · 9.0T1059Command and Scripting InterpreterT1055Process Injection+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    77.3%Top 0.44%
    69.2priority
  3. CVE-2017-0210Microsoft Internet Explorer Privilege Escalation Vulnerability
    Microsoft · Internet ExplorerKEVEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1185Browser Session Hijacking
    AI mapping from the description · primary impact
    22.3%Top 2.3%
    48.7priority
  4. CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
    Adobe · Flash PlayerKEVEnd of lifeMedium · 6.1T1204.001Malicious LinkT1098Account Manipulation+2 more
    MITRE CTID mapping of the KEV entry · primary impact
    6.2%Top 6.5%
    46.0priority
  5. CVE-2020-5267Possible XSS vulnerability in ActionView
    rails · actionviewPublic exploitMedium · 4.0T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    1.5%Top 25%
    22.7priority
  6. CVE-2019-3708Cross-Site Scripting Vulnerability in OVA file upload feature
    Dell EMC · Dell EMC IsilonSD Management ServerHigh · 8.3T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    2.2%Top 17%
    22.4priority
  7. CVE-2020-15183Reflected XSS leading to RCE in SoyCMS
    inunosinsi · soycmsHigh · 8.4T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    1.7%Top 22%
    21.4priority
  8. CVE-2020-11083Stored XSS in October
    October CMS · OctoberPublic exploitLow · 3.5T1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    1.1%Top 33%
    20.8priority
  9. CVE-2018-11059RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability
    Dell EMC · RSA ArcherHigh · 8.2T1189Drive-by CompromiseT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    1.4%Top 28%
    20.1priority
  10. CVE-2019-18578Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability
    Dell · XtremIOCritical · 9.0T1189Drive-by CompromiseT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    1.1%Top 34%
    19.6priority
  11. CVE-2020-15179HTML Injection in ScratchSig
    InternationalScratchWiki · wiki-scratchsigHigh · 8.0T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    1.2%Top 31%
    19.3priority
  12. CVE-2018-11075DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities
    RSA · Authentication ManagerMedium · 5.8T1204.002Malicious FileT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    1.5%Top 26%
    18.9priority
  13. CVE-2020-5217Directive injection when using dynamic overrides with user input in RubyGems secure_headers
    Twitter · secure_headersMedium · 4.4T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    1.8%Top 21%
    18.8priority
  14. CVE-2018-11073DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities
    RSA · Authentication ManagerMedium · 6.5T1189Drive-by CompromiseT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    1.1%Top 34%
    17.7priority
  15. CVE-2020-15118Cross-Site Scripting in Wagtail
    wagtail · wagtailMedium · 5.7T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    1.1%Top 34%
    17.1priority
  16. CVE-2020-11036XSS in GLPI
    glpi-project · GLPIHigh · 7.6T1189Drive-by CompromiseT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    0.8%Top 43%
    16.7priority
  17. CVE-2020-5283XSS vulnerability in CVS show_subdir_lastmod support
    viewvc · viewvcLow · 3.1T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    1.4%Top 28%
    16.5priority
  18. CVE-2020-11055Cross-site Scripting in BookStack
    BookStackApp · BookStackMedium · 6.3T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    0.8%Top 44%
    15.6priority
  19. CVE-2020-5241XSS/Script injection vulnerability in matestack
    matestack · matestack-ui-coreHigh · 7.7T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    0.6%Top 50%
    15.4priority
  20. CVE-2020-15162Stored XSS in PrestaShop
    PrestaShop · PrestaShopMedium · 5.4T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    MITRE CTID mapping of the CVE · follow-on activity
    0.8%Top 44%
    15.1priority
  21. CVE-2020-3460Cisco Data Center Network Manager Cross-Site Scripting Vulnerability
    Cisco · Cisco Data Center Network ManagerMedium · 4.7T1185Browser Session HijackingT1565.002Transmitted Data Manipulation
    MITRE CTID mapping of the CVE · follow-on activity
    0.7%Top 46%
    14.0priority
  22. CVE-2020-5339RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the…
    Dell · RSA Authentication ManagerMedium · 4.8T1189Drive-by CompromiseT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    0.7%Top 48%
    13.7priority
  23. CVE-2020-5340RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the…
    Dell · RSA Authentication ManagerMedium · 4.8T1189Drive-by CompromiseT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    0.7%Top 48%
    13.7priority
  24. CVE-2019-18571The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a…
    Dell · RSA Identity Governance & LifecycleMedium · 5.4T1204.002Malicious FileT1059.007JavaScript+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    0.5%Top 57%
    12.4priority

Passages that support these links

↑ ↓ chooseEnter openEsc close