CVE-2018-10252

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its...

CVE-2018-10252

CVE-2018-10252 affects Actiontec WCB6200Q prior to firmware 1.1.10.20a. The admin login session cookie is generated insecurely (time-of-day rounded to 10 ms), allowing an attacker to step through possible session IDs and hijack admin sessions. Once a valid session is obtained, the attacker can ad...

Stored Cross-Site Scripting Vulnerability at Order Invoice in Cloud EC E-commerce System

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system order invoice at the existence of stored cross-site scripting vulnerabilities. An...

Code Execution Vulnerability in TP-Link Enterprise Routers

Tplink ER5110G, Tplink ER5120G and Tplink WAR1300L are enterprise VPN routers and enterprise wireless VPN routers. A code execution vulnerability exists in TP-Link Enterprise Routers. An attacker can exploit the vulnerability to obtain the router's administrator username and password, or hijack a...

Design/Logic Flaw

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

CVE-2018-6959

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

CVE-2018-6959

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

CVE-2018-6959

CVE-2018-6959 affects VMware vRealize Automation (vRA) prior to 7.4.0, with a vulnerability in handling of session IDs that may allow hijacking a valid vRA user session. The Nessus/NVE and VMware advisory entries show affected versions up to 7.3.x (7.0.x–7.3.x) and indicate remediation via update...

VMware vRealize Automation Session Hijacking Vulnerability

VMware vRealize Automation vRA is a suite of cloud automation software from VMware. The software supports automated delivery of personalized infrastructure, deployment across multi-vendor, hybrid cloud infrastructures, simplified application release automation and continuous delivery. A session...

Design/Logic Flaw

The web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-8422

The web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-8422

The CVE-2014-8422 entry affects Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices prior to R3.32.0, where the web-based management (WBM) interface generates session cookies with insufficient entropy, enabling remote attackers to hijack sessions via brute-force. The provi...

CVE-2014-8422

The web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

SAP Cloud Platform Session Fixation Vulnerability

SAP Cloud Platform is an open Platform-as-a-Service PaaS cloud platform from SAP. The platform is used to build and extend personalized, collaborative and mobile-enabled cloud applications. A session fixation vulnerability exists in SAP Cloud Platform version 2.0, which stems from the program...

[ASA-201804-4] apache: multiple issues

Arch Linux Security Advisory ASA-201804-4 ========================================= Severity: Medium Date : 2018-04-04 CVE-ID : CVE-2017-15710 CVE-2017-15715 CVE-2018-1283 CVE-2018-1301 CVE-2018-1302 CVE-2018-1303 CVE-2018-1312 Package : apache Type : multiple issues Remote : Yes Link :...

Mail.ru: Partner Account Takeover on https://www.delivery-club.ru через пользовательский аккаунт.

Improper access control allowed user account to perform privileged actions for partner's account with same ID. Ситуация аналогичная с 324230, но в другую сторону. Можно захватывать партнерские аккаунты посредством сессии с основного сайта...

Sandoba CP:Shop CMS 2016.1 Cross Site Scripting

Document Title: =============== Sandoba CP:Shop CMS v2016.1 - Multiple Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2122 Release Date: ============= 2018-03-02 Vulnerability Laboratory ID VL-ID:...

LDAP Account Manager 6.2 Cross Site Scripting

Affected Software: LDAP Account Manager 6.2 Pentester: MichaA KAdzior CVE: CVE-2018-8763, CVE-2018-8764 Vulnerabilities : 1. Cross-site scripting reflected CVE-2018-8763 : ================================ Risk: HIGH Summary: Reflected Cross Site Scripting vulnerability has been found during the...

WolfCMS Cross-Site Scripting Vulnerability

Wolf CMS is a lightweight content management system written in PHP. A reflective cross-site scripting vulnerability exists in WolfCMS 0.8.3.1 in the "Create New File" and "Create New Directory" input boxes under the "File" tab. An attacker can exploit this vulnerability to conduct session...

CVE-2018-1000087

WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker c...