CVE-2021-27513-CVE-2021-27514

exploit-eyesofnetwork Versione 5.3.5 fino a 5.3.10 root@kitploit: CVE-2021-27513 / CVE-2021-27514 The brute-forcing can take a very long time on non production environement cause "sessionid" is created at every login but every sessionid generated by the app are valide for the PoC i deployed an...

CVE-2023-0264

PoC per CVE-2023-0264 Vulnerabilità di Keycloak che consente il dirottamento della sessione durante il flusso del codice di autorizzazione Vedi https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisiti Docker curl jq python3 o un altro strumento per servire file statici su HTTP Passaggi per ...

CVE-2020-10199_POC-EXP

Versione interessata + + EXP: python3 cve-2020-10199poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version = 3.21.1 + +----------------------------------------------------------------------------------------------------------+...

details-for-CVE-2022-46505

details-for-CVE-2022-46505 Bug di ripresa della sessione in MatrixSSL 1. Descrizione del bug Un problema in MatrixSSL 4.5.1-open e versioni precedenti porta al mancato controllo sicuro del campo SessionID, con conseguente uso improprio di un MasterSecret tutto a zero che può decrittare dati...

toutatis

Toutatis 👋 नमस्ते! किसी भी पेशेवर पूछताछ या सहयोग के लिए, कृपया मुझसे यहाँ संपर्क करें: [email protected] 📧 कृपया पत्राचार के लिए अपने पेशेवर ईमेल का उपयोग करें। इसे संक्षिप्त और मधुर रखें, और सभी अंग्रेजी में! Toutatis एक उपकरण है जो आपको इंस्टाग्राम खातों से ईमेल, फ़ोन नंबर और अधिक जानकारी...

CVE-2014-3466_PoC

Prova de Conceito para CVE-2014-3466 estouro de buffer no GnuTLS: verificação do comprimento do ID de sessão Informações Consulte: https://bugzilla.redhat.com/showbug.cgi?id=1101932 Este não é um exploit armado. estejam avisados: este código python é feio, eu praticamente criei o ServerHello à mã...

GHSA-FH3R-G96V-F578 @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

Cross-Session Data Exposure via Caller-Controlled sessionid Project / Repository: arikusi/deepseek-mcp-server Affected version / commit tested: 1.6.0 / 04f28be2c6e99d3d4e443a6ae37cc35f0a71554a Vulnerability type: Authorization bypass / cross-session data exposure Authentication required: No Summa...

BIT-KEYCLOAK-2024-7341 Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

PT-2026-81891

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.43 through 7.0.109...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

Important: Red Hat Security Advisory: python-urwid security update

An update for python-urwid is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

EUVD-2026-63219

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives...

Important: python-urwid

Issue Overview: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of...

Important: python-urwid

Issue Overview: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of...

CVE-2026-47234

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

EUVD-2026-57215

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47234

CVE-2026-47234 affects Admidio before 5.0.10. When debug logging is enabled, Admidio logs raw cookie values and the active session ID via Session::setCookie() and Session::start(), exposing live session tokens (including auto-login cookies) in application logs. This creates a local/credential-sto...