1767 matches found
CVE-2019-10119
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...
CVE-2013-4629
The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method...
CVE-2013-4092
The SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent attackers to obtain sensitive information by leveraging the presence of 1 a session ID in the jsessionid field to secsphLogin.jsp or 2 credentials in the jpassword parameter to...
CVE-2009-2165
SerendipityNZ aka SimpleBoxes Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id...
CVE-2007-6470
phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session ID values in files under tmp/, and then hijack sessions via PHPSESSID cookies...
CVE-2024-36339
creationtimestamp| type| source ---|---|--- 2025-05-13 17:31:08+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16175...
Amazon Linux 2 : jetty (ALAS-2025-2855)
It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2855 advisory. For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On...
CVE-2022-42940
creationtimestamp| type| source ---|---|--- 2025-05-07 16:23:09+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15336...
CVE-2021-47663
Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full access...
PT-2025-17724 · Franka Robotics · Franka Emika Robot
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An issue exists due to improper JSON Web Tokens implementation, allowing an unauthenticated remote attacker to guess a valid session ID. This enables the attacker to impersonate a user and...
Delta Electronics COMMGR Code Execution Vulnerability
Delta Electronics COMMGR is a communication management software from Delta Electronics China. A code execution vulnerability exists in Delta Electronics COMMGR that stems from insufficient randomness in session ID generation, which can be exploited by an attacker to brute-force break the session ...
CVE-2025-3495
Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs CWE-338. An attacker could easily brute force a session ID and load and execute arbitrary code...
CVE-2025-3495
Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs CWE-338. An attacker could easily brute force a session ID and load and execute arbitrary code...
CVE-2025-3495 COMMGR - Insufficient Randomization Authentication Bypass
Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs CWE-338. An attacker could easily brute force a session ID and load and execute arbitrary code...
PT-2025-16552 · Delta Electronics · Commgr
Name of the Vulnerable Software and Affected Versions: Delta Electronics COMMGR versions 1 through 2 Description: The issue is related to insufficiently randomized values used to generate session IDs, which could allow an attacker to brute force a session ID and potentially load and execute...
CVE-2025-22962
A critical remote code execution RCE vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mode is enabled. An attacker with a valid session ID sessid can send specially crafted POST requests to the /json endpoint, enabling arbitrary...
CVE-2024-35050
An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin...
SUSE CVE-2022-47930
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session...
Azure Linux 3.0 Security Update: curl (CVE-2024-0853)
The version of curl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0853 advisory. - curl inadvertently kept the SSL session ID for connections in its cache even when the verify status OCSP stapli...