CVE-2024-2493

Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00...

CVE-2024-2493 Session Hijacking Vulnerability in Hitachi Ops Center Analyzer

Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00...

CVE-2024-2493 Session Hijacking Vulnerability in Hitachi Ops Center Analyzer

Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00...

CVE-2024-2493

CVE-2024-2493 : A session hijacking vulnerability affects Hitachi Op s Center Analyzer (versions 10.0.0-00 up to, but not including, 11.0.1-00). The root cause is a flaw allowing an attacker to hijack an active session, compromising access control. Impact details are described as a session hijack...

Hitachi Ops Center Analyzer security vulnerabilities

Hitachi Ops Center Analyzer is a data center management software from Hitachi, Ltd Hitachi, Japan. It monitors, reports, and correlates end-to-end performance from servers to storage. A security vulnerability exists in Hitachi Ops Center Analyzer version 10.0.0-00 through versions prior to...

CVE-2024-2493: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00...

PT-2024-3138

Name of the Vulnerable Software and Affected Versions Hitachi Ops Center Analyzer versions 10.0.0-00 through 11.0.1-00 Description The issue is related to the absence of the Secure flag in HTTPS session cookies, which can be exploited by a remote attacker to gain unauthorized access to protected...

HackerOne: Session Not Expire / 2FA Bypass

Vulnerability description not provided...

Session Hijacking

org.keycloak:keycloak-services is vulnerable to Session Hijacking. This vulnerability is due to an issue where an active Keycloak session can be hijacked by initiating a new authentication using the query parameter prompt=login, prompting the user to enter their credentials again. If the user...

Session Hijacking

dolibarr/dolibarr is vulnerable to Session Hijacking. The vulnerability is due to inadequate user session management, allowing authenticated attackers to hijack victim users' session cookies and gain access to the CSRF protection tokens through interaction with a malicious web page, consequently...

Keycloak vulnerable to session hijacking via re-authentication

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication having the query parameter prompt=login and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover...

Dell Storage Resource Manager Resource Management Error Vulnerability

Dell Storage Resource Manager is a software for managing storage resources from Dell USA. A resource management error vulnerability exists in Dell Storage Resource Manager version 4.9.0.0 and earlier, which stems from the presence of session fixation and can be exploited by an unauthenticated...

PT-2024-24441

Name of the Vulnerable Software and Affected Versions PineWise WP Google Analytics Events versions through 2.8.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

CrushFTP Remote Code Execution Exploit

This Metasploit exploit module leverages an improperly controlled modification of dynamically-determined object attributes vulnerability CVE-2023-43177 to achieve unauthenticated remote code execution. This affects CrushFTP versions prior to 10.5.1. It is possible to set some user's session...

CVE-2024-29023

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...

CVE-2024-29022

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...