CVE-2026-22903 Stack Overflow via SESSIONID Cookie in lighttpd

An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections...

PT-2026-7081

Name of the Vulnerable Software and Affected Versions lighttpd affected versions not specified Description An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the lighttpd server, potentially...

EUVD-2014-0175

Malware in sbrugna...

EUVD-2025-32129

Malicious code in bioql PyPI...

EUVD-2022-31811

Malicious code in bioql PyPI...

CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation...

The vulnerability of the Telnet service of the TOTOLINK N200RE V5 router’s microprogramming system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Telnet service provided by the TOTOLINK N200RE V5 microprogramming router lies in the use of strictly encrypted login credentials, with the SESSIONID file stored in a cookie. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected...

PT-2022-21348

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.6 Description The issue concerns a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute. This problem is present when the URL is invalid. The estimated number of potentially affected devices is...

PT-2022-20659

Name of the Vulnerable Software and Affected Versions TopIDP3000 Topsec Operating System version tos 3.3.005.665b.15 smpidp Description The issue allows attackers to perform a brute-force attack via a crafted session id cookie. Recommendations For TopIDP3000 Topsec Operating System version tos...

CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation...

CVE-2021-27771

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...

PT-2022-17700 · Cherwell · Cherwell Service Management

Name of the Vulnerable Software and Affected Versions: Cherwell Service Management version 10.2.3 Description: An issue was discovered in the web application where the ASP.NET Sessionid cookie is not protected by the Secure flag, making it prone to interception by an attacker if traffic is sent...

PT-2020-18984

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions prior to 1911 Description The issue allows the Session ID cookie value to be sent in the URL, which could be stolen from browser history or log files, leading to information disclosure. Recommendations For versions prio...

PT-2017-3096

Name of the Vulnerable Software and Affected Versions Trend Micro Threat Discovery Appliance version 2.6.1062r1 Description The issue allows a remote, unauthenticated attacker to delete arbitrary files as root due to directory traversal when processing a session id cookie. This can be used to...

PT-2014-8978

Name of the Vulnerable Software and Affected Versions Zenoss Core versions prior to 4.2.5 SP161 Description The issue allows remote attackers to hijack sessions by leveraging an unattended workstation, as the session ID cookie has an infinite lifetime. Recommendations For versions prior to 4.2.5...

CVE-2014-9386: Undefined Security Weakness

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...

CVE-2014-0090

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...

Session fixation

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...

CVE-2014-0090: Improper Authentication

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...

WatchGuard Firewall XTM 11.7.4u1 - Remote Buffer Overflow

Exploit for hardware platform in category remote exploits !/usr/bin/perl -w Exploit Title: WatchGuard Firewall XTM version 11.7.4u1 - Remote buffer overflow exploit sessionid cookie Date: Oct 18 2013 Exploit Author: email protected a.k.a. email protected Vendor Homepage: http://www.watchguard.com...