CVE-2021-31769

CVE-2021-31769 affects MyQ X Smart prior to 8.2. The vulnerability allows remote code execution because administrative session data can be read from %PROGRAMFILES%\MyQ\PHP\Sessions, and the non‑administration‑restricted “Select server file” feature enables attackers to inject arbitrary OS command...

Exploit for Incorrect Permission Assignment for Critical Resource in Wftpserver Wing_Ftp_Server

What's this Wing FTP Server 6.2.5 - Privilege Escalation...

CVE-2020-3148

A vulnerability in the web-based interface of Cisco Prime Network Registrar CPNR could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An...

CVE-2020-3148 Cisco Prime Network Registrar Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based interface of Cisco Prime Network Registrar CPNR could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An...

Cisco Prime Network Registrar Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based interface of Cisco Prime Network Registrar CPNR could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An...

CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

CVE-2017-12225

A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...

Cisco Prime LAN Management Solution Session Fixation Vulnerability

A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session. The vulnerability is due to the reuse of a preauthentication session token as part of the postauthentication session. ...

F5 BIG-IP - Configuration utility CSRF vulnerability

A cross-site request forgery CSRF vulnerability in the Traffic Management User Interface TMUI, also referred to as the Configuration utility, may allow a malicious site to force an administrative session to log out and require re-authentication. SPDX-FileCopyrightText: 2016 Greenbone AG Some text...

The vulnerability of the GNU Mailman mailing system allows a hacker to replace a user during an administrator session.

The vulnerability in the GNU Mailman mailing system’s web interface is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to replace the user during an administrator session...

Symantec Endpoint Protection Manager < 12.1 RU6 MP1 Multiple Vulnerabilities (SYM15-007)

The version of Symantec Endpoint Protection Manager SEPM running on the remote host is prior to 12.1 RU6 MP1. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the password reset functionality that allows a remote attacker, using a crafted password reset action, to...

Authentication flaw

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session...

Powerschool 4.3.6/5.1.2 Javascript File Request Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22611/info Powerschool is prone to an information-disclosure vulnerability because the application discloses information about administrative session variables. An attacker can exploit these issue to obtain sensitive...

Serv-U FTP server security vulnerabilities

Resource exhaustion, administrative session hijacking...

CVE-2007-5384

Multiple cross-site request forgery CSRF vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistanc...

Session fixation

Session fixation vulnerability in Joomla! before 1.0.13 aka Sunglow allows remote attackers to hijack administrative web sessions via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative sessio...

HP Systems Insight Manager for Windows unauthorized access

Invalid session cookie processing allows administrative session hijacknig...

Powerschool 4.3.6/5.1.2 - JavaScript File Request Information Disclosure

source: https://www.securityfocus.com/bid/22611/info Powerschool is prone to an information-disclosure vulnerability because the application discloses information about administrative session variables. An attacker can exploit these issue to obtain sensitive information that may aid in other...

Powerschool 4.3.65.1.2 - JavaScript File Request Information Disclosure

Powerschool 4.3.65.1.2 - JavaScript File Request Information Disclosure source: https://www.securityfocus.com/bid/22611/info Powerschool is prone to an information-disclosure vulnerability because the application discloses information about administrative session variables. An attacker can exploi...