OrientDB Server Community Edition uses insufficiently random values to generate session IDs

OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values in the server/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by...

Moderate severity vulnerability that affects org.springframework:spring-core

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...

GHSA-45VG-2V73-VM62 Moderate severity vulnerability that affects org.springframework:spring-core

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...

Security Bulletin: Multiple security vulnerabilities in GSKit used by Edge Caching proxy of WebSphere Application Server

Summary There are multiple security vulnerabilities in the GSKit used by Edge Caching proxy of WebSphere Application Server. This is a separate install from WebSphere Application Server. You only need to apply this if you use the Edge Caching Proxy. Vulnerability Details CVEID: CVE-2018-1447...

Security Bulletin: IBM Security SiteProtector System is affected by GSKit vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in GSKit. Vulnerability Details CVEID: CVE-2018-1428 DESCRIPTION: IBM GSKit uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Scor...

CVE-2018-12520

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard...

Design/Logic Flaw

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard...

CVE-2018-12520

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard...

PT-2018-11228 · Ntop +1 · Ntopng +1

Name of the Vulnerable Software and Affected Versions: ntopng versions prior to 3.4.180617 Description: An issue was discovered where the pseudo-random number generator PRNG involved in generating session IDs is not seeded at program startup, resulting in deterministic session IDs for active user...

Multiple Dell Products Brute Force Vulnerabilities

Dell EMC iDRAC6, among others, is a system management solution that includes both hardware and software from Dell USA. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. A security vulnerability exists in multiple Dell products that stems...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products

Summary Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak...

ntop-ng Authentication Bypass Vulnerability

Exploit for linux platform in category remote exploits Vulnerability title: ntop-ng 3.4.180617 - Authentication Bypass Author: Ioannis Profetis Contact: me at x86.re Vulnerable versions: 3.4.180617-4560 Fixed version: 3.4.180617 Link: ntop.org Date: 2.07.2018 CVE-2018-12520 Product Details ntopng...

Security Bulletin: IBM WebSphere MQIPT Session IDs are predictable (CVE-2015-0173)

Summary The MQIPT Session IDs for HTTP communication that are generated by MQIPT V2.0 and later are predictable. Vulnerability Details CVEID: CVE-2015-0173 DESCRIPTION: IBM WebSphere MQ Internet Pass-Thru HTTP connection management contains a security flaw which could allow interception of MQ...

CVE-2018-10285

The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authentication...

Code injection

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...

CVE-2018-1426

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...

CVE-2018-1426

CVE-2018-1426 affects IBM GSKit: it duplicates the PRNG state across fork() when multiple ICC instances load, risking duplicate Session IDs and key material. Documents confirm the vulnerability description and its association with GSKit in IBM products; however, a concrete, product-specific fixed...

CVE-2018-1426

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...

Webmin < 1.230 miniserv.pl Authentication Bypass

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.230. It is, therefore, affected by a potential authentication bypass via spoofed session IDs. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108548; scriptversion"1.5";...

CVE-2018-1426: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...