1693 matches found
Information Disclosure
centreon/centreon is vulnerable to information disclosure. The session ID is found to be within the server response body, potentially allowing an attacker to obtain the session ID through another vulnerability such as cross-site scripting...
CVE-2020-10945
Centreon before 19.10.7 exposes Session IDs in server responses...
CVE-2020-10945
Centreon before 19.10.7 exposes Session IDs in server responses, constituting an information-disclosure vulnerability. The issue affects Centreon up to version 19.10.6 (prior to 19.10.7) and is confirmed by multiple sources in connected documents. The root cause is exposure of session identifiers...
Palo Alto Networks PAN-OS 7.1.x < 8.1.14 / 8.0.x < 8.1.14 / 8.1.x < 8.1.14 / 9.0.x < 9.0.8 Session Fixation
The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.14 or 8.0.x prior to 8.1.14 or 8.1.x prior to 8.1.14 or 9.0.x prior to 9.0.8. It is, therefore, affected by a session fixation vulnerability. - The GlobalProtect Portal feature in PAN-OS does not set a new...
CVE-2020-9502
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...
CVE-2020-9502
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...
Code injection
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...
PAN-OS: GlobalProtect Portal PHP session fixation vulnerability
The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. Work around: There are no known workarounds for this issue...
CVE-2020-9502
CVE-2020-9502 affects some Dahua products built before December 2019 where Session IDs are predictable. This allows an attacker, with network access and no authentication or user interaction, to craft data packets to target devices. The available documents consistently describe the issue as predi...
CVE-2020-9502
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...
NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration
Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Date: 2020-05-04 Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session Enumeration = $maxproc while pcntlwaitpid0...
CVE-2020-5892
In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...
Code injection
In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...
CVE-2020-5892
CVE-2020-5892 affects the Windows BIG-IP Edge Client components (APM, Edge Gateway, FirePass legacy). The root issue is that an attacker with sufficient local privileges on a client machine could obtain the full session ID from process memory. Affected versions include BIG-IP Edge Client 7.1.5–7....
CVE-2020-5892
In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...
CVE-2020-10714
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...
CVE-2020-11728
An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time and the incrementing sessionid can impersonate a session...
CVE-2020-1773
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...
Nagios Log Server Incorrect Access Control Vulnerability
Nagios Log Server is a powerful enterprise-grade log monitoring and management application that allows organizations to quickly and easily view, sort, and configure logs from any source on any given network. An incorrect access control vulnerability exists in Nagios Log Server 2.1.3. An attacker...