CVE-2021-44512

World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory...

Fortinet FortiClient 安全漏洞

Fortinet FortiClient is a fabric agent from Fortinet USA, Inc. It is used to provide protection, compliance and secure access in a single modular lightweight client.Fortinet FortiClient for Windows 7.0.0, versions 6.4.6 and earlier and 6.2.8 and earlier are vulnerable to an authorization error. A...

CVE-2021-36320

Dell Networking X-Series firmware versions prior to 3.0.1.8 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially hijack a session and access the webserver by forging the session ID...

PT-2021-21222

Name of the Vulnerable Software and Affected Versions Dell Networking X-Series firmware versions prior to 3.0.1.8 Description The issue allows a remote unauthenticated attacker to potentially hijack a session and access the webserver by forging the session ID. This is due to an authentication...

Fortinet FortiClientEms code issue vulnerability

Fortinet FortiClientEms is a centralized central management system from Fortinet, Inc. A code issue vulnerability exists in Fortinet FortiClientEms, which can be exploited by attackers to gain administrator privileges by reusing an unexpired administrator user session ID...

PT-2021-4339

Name of the Vulnerable Software and Affected Versions FortiClientEMS versions 6.4.2 and below FortiClientEMS versions 6.2.8 and below Description The issue is related to insufficient session expiration, which may allow an attacker to reuse unexpired admin user session IDs and gain admin privilege...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

CVE-2021-39899 affects GitLab CE/EE (all versions). An attacker with physical access to a user’s machine can brute-force the user’s password via the change password function. There is a rate limit, but the attack may succeed by stealing the session_id from the compromised account and distributing...

CVE-2021-39899: Weak Password Recovery Mechanism for Forgotten Password

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-40923

creationtimestamp| type| source ---|---|--- 2021-10-01 20:15:34+00:00| seen| https://t.me/cibsecurity/29823...

CVE-2021-22948

Vulnerability in the generation of session IDs in revive-adserver 5.3.0, based on the cryptographically insecure uniqid PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account...

CVE-2021-22948

Vulnerability in the generation of session IDs in revive-adserver 5.3.0, based on the cryptographically insecure uniqid PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account...

CVE-2021-22948

Vulnerability in the generation of session IDs in revive-adserver 5.3.0, based on the cryptographically insecure uniqid PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account...

Design/Logic Flaw

Vulnerability in the generation of session IDs in revive-adserver 5.3.0, based on the cryptographically insecure uniqid PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account...

CVE-2021-22948

Vulnerability in the generation of session IDs in revive-adserver 5.3.0, based on the cryptographically insecure uniqid PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account...

MGASA-2021-0441 Updated libssh packages fix security vulnerability

A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secrethash and the other sessionid. Initially, both of them are the same, but after key re-exchange, previous sessionid is kept...