Multiple Weidmueller Product Information Disclosure Vulnerabilities

Weidmueller IE-SW-VL05M-5TX and so on are an industrial Ethernet switch from Weidmueller, Germany. An information disclosure vulnerability exists in multiple Weidmueller products, which can be exploited by an attacker to guess the authentication information in a cookie...

CVE-2019-16674

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network...

The vulnerability of the DBUS_COOKIE_SHA1 function in the D-Bus library of the process-interaction system allows a perpetrator to compromise data integrity or gain unauthorized access to protected information.

The vulnerability of the DBUSCOOKIESHA1 function in the D-Bus library related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow an attacker to compromise data integrity by replacing the uid value or gaining unauthorized access to protected information by usin...

GHSA-J3JP-GVR5-7HWQ python-engineio vulnerable to Cross-Site Request Forgery (CSRF)

WebSocket cross-origin vulnerability Impact This is a Cross-Site Request Forgery CSRF vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies. Patches python-engineio version 3.9.0 patches this vulnerability by adding server-side Origin header checks...

PT-2019-4805 · Python · Python-Engineio

Name of the Vulnerable Software and Affected Versions: python-engineio versions 3.8.2 and earlier Description: The issue is related to a Cross-Site WebSocket Hijacking CSWSH vulnerability, also referred to as a Cross-Site Request Forgery CSRF vulnerability. This vulnerability allows attackers to...

USN-4015-2 dbus vulnerability

USN-4015-1 fixed a vulnerability in DBus. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Joe Vennix discovered that DBus incorrectly handled DBUSCOOKIESHA1 authentication. A local attacker could possibly use this issue to bypass...

Microsoft Azure DevOps Server and Team Foundation Server Cross Site Scripting Vulnerability

Description Microsoft Team Foundation Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...

Unauthorized Access Vulnerability in nzcms

Jinhua Ningzhi Network Technology Co., Ltd. is / government agencies / public security agencies / military agencies / school institutions / business companies / e-commerce office platform construction technology and service providers. Unauthorized access vulnerability exists in nzcms. The...

CVE-2018-12666

SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cookies, which allow remote attackers to bypass authentication and gain administrator access by setting the authLevel cookie to 255...

Adobe Experience Manager HTML Injection Vulnerability (CNVD-2019-06893)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. An HTM...

CVE-2018-12455

Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie...

Nes has an unspecified vulnerability

Nes is a WebSocket adapter plugin for hapi routing. A security vulnerability exists in Nes 6.4.0 and earlier versions. When websocket authentication is set to 'cookie', an attacker can exploit the vulnerability by submitting an invalid cookie to shut down the node process...

CVE-2017-16025

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to cookie. Submitting an invalid cookie on the websocket...

DRUPAL-CONTRIB-2018-021

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't provide CSRF protection when processing authenticated traffic using cookie-based authentication. This vulnerability is mitigated by the fact that an...

Cookie Authentication Failed

This plugin is raised when the scanner has not been able to authenticate against the web application using the cookies provided in the scan policy. Check the output of the plugin to get an explanation of the issue encountered by the scan. No source data...

Cookie Authentication Succeeded

This is an informational notice that the scanner was able to successfully authenticate against the web application using the cookies provided in the scan policy. No source data...

WordPress Super Simple Custom CSS 1.2 Cross Site Scripting

Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Super Simple Custom CSS 1.2 Super Simple Custom CSS is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

There is a logical design flaw in the Mt. Song enrollment system

Song Song enrollment system is an asp + access to develop the enrollment system source code. Song Song registration system there is a logical design vulnerability, attackers can use the vulnerability to bypass cookie authentication to log in to the system, access to sensitive information and...

Magento CMS Multiple Security Vulnerabilities

Magento CMS is prone to multiple security vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Override Access Vulnerability in S-CMS V3.0 dbm.asp Page

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS V3.0 dbm.asp page has an override access vulnerability that can be exploited by an attacker to bypass Cookies authentication, execute arbitrary sql statements, and obtain the administrator's passwo...