2904 matches found
CVE-2020-15910
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...
CVE-2020-15909
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
CVE-2020-15909
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
Design/Logic Flaw
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...
Session fixation
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
CVE-2020-15909
SolarWinds N-central up to 2020.1 is described as vulnerable to session hijacking via the JSESSIONID cookie. The JSESSIONID attribute is not validated against multiple sources (e.g., source IP, MFA claims) while the victim remains logged in, allowing an attacker to steal the cookie and reuse it b...
CVE-2020-15909
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
CVE-2020-15910
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...
CVE-2020-15910
This CVE concerns SolarWinds N-Central, affected in version 12.3 GA and lower. The underlying issue is that the JSESSIONID cookie is not marked HttpOnly, enabling client-side scripts to influence or exfiltrate the cookie. The described impact is that an attacker could lure a user to a crafted pag...
n-passport.jp Cross Site Scripting vulnerability OBB-1367287
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
z-n-e.de Cross Site Scripting vulnerability OBB-1333026
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
m-o-n-o.de Cross Site Scripting vulnerability OBB-1326620
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
PT-2020-14815 · Philips · Intellivue Mx750 +9
Name of the Vulnerable Software and Affected Versions: IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750, MX800, MX850, MP2-MP90, and IntelliVue X2 and X3 Versions N and prior Description: The product receives input or data but does not validate or incorrectly validates that the...
CVE-2018-17773
Ingenico Telium 2 POS terminals have a buffer overflow via SOCKETTASK in the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N...
CVE-2018-17771
Ingenico Telium 2 POS terminals have hardcoded FTP credentials. This is fixed in Telium 2 SDK v9.32.03 patch N...
CVE-2018-17768
Ingenico Telium 2 POS terminals have an insecure TRACE protocol. This is fixed in Telium 2 SDK v9.32.03 patch N...
CVE-2018-17769
Ingenico Telium 2 POS terminals have a buffer overflow via the 0x26 command of the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N...
CVE-2018-17767
Ingenico Telium 2 POS terminals have hardcoded PPP credentials. This is fixed in Telium 2 SDK v9.32.03 patch N...