484 matches found
CVE-2025-40742
CVE-2025-40742 affects Siemens SIPROTEC 5 devices (a wide list including 6MD84/85/86/89, 6MU85, 7KE85, 7SA82/86/87, 7SD82/86/87, 7SJ81/82/85/86, 7SK82/85, 7SL82/86/87, 7SS85, 7ST85/86, 7SX82/85, 7SY82, 7UM85, 7UT82/85/86/87, 7VE85, and Compact 7SX800). The root cause is exposure of session identi...
PT-2025-28400 · Siemens · Siprotec 5 7Sa82 +16
Name of the Vulnerable Software and Affected Versions: SIPROTEC 5 6MD84 CP300 All versions SIPROTEC 5 6MD85 CP300 All versions SIPROTEC 5 6MD86 CP300 All versions SIPROTEC 5 6MD89 CP300 All versions SIPROTEC 5 6MD89 CP300 V9.6 All versions SIPROTEC 5 6MU85 CP300 All versions SIPROTEC 5 7KE85 CP30...
PT-2025-27472 · Unknown · Filebrowser
Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.9 Description: The issue concerns the leakage of JSON Web Tokens JWT used as session identifiers due to their inclusion as GET parameters in URLs. This leakage can occur when a user accesses certain URLs,...
CVE-2023-1898
Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active user’s session...
CVE-2019-10049
It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code that is executed in the context of the victim use...
PT-2025-6969 · Gatesair · Gatesair Maxiva Vaxt
Name of the Vulnerable Software and Affected Versions: GatesAir Maxiva UAXT, VAXT transmitters affected versions not specified Description: A session hijacking issue exists in the web-based management interface, allowing unauthenticated attackers to access exposed log files at "/logs/debug/xteLog...
CVE-2020-26228
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in...
The vulnerability of the web service for transmitting information through temporary links, Password Pusher, is related to an incorrect session timeout restriction, allowing attackers to gain unauthorized access to the system.
The vulnerability of the web service for transmitting information through temporary links, Password Pusher, is related to incorrect time-out restrictions on sessions. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the system using o...
U.S. Dept Of Defense: ASP.NET Application Trace Enabled
The ASP.NET application trace feature was enabled on a public-facing URL, which exposed sensitive internal information, including Session ID values and the physical file paths of server-side resources. This vulnerability could have allowed attackers to gain unauthorized insights into the server...
Authorization Bypass Through User-Controlled Key
Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to improper handling of user session identifiers through the users.queries.php component. An attacker can escalate privileges and perfo...
UBUNTU-CVE-2024-50339
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue...
Session Fixation
Apache Kylin is vulnerable to Session Fixation. The vulnerability is due to improper handling of session identifiers, allowing an attacker to hijack a user's session...
PT-2024-7682 · Glpi +1 · Glpi +1
Name of the Vulnerable Software and Affected Versions: GLPI versions 9.5.0 through 10.0.16 Description: The issue is related to incorrect session management in the GLPI system, which can allow a remote attacker to gain full access to the application by intercepting a session. An unauthenticated...
CVE-2024-47945
The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions...
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API UserSessionAjax.getSessionList.dwr calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack...
CVE-2024-37183
Plain text credentials and session ID can be captured with a network sniffer...
Westermo L210-F2G Lynx Security Vulnerability
The Westermo L210-F2G Lynx is an industrial switch from Westermo Sweden. A security vulnerability exists in the Westermo L210-F2G Lynx. An attacker can exploit the vulnerability to obtain plain text credentials and session IDs...
ZenML Code Issue Vulnerability
ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A code issue vulnerability exists in ZenML version 0.56.3 that stems from an insufficient session validity period. An attacker exploiting this vulnerability could reuse old sessi...
The vulnerability of the `ticket_age_add` function in the Go programming language allows a violator to gain unauthorized access to session identifiers.
The vulnerability of the ticketageadd function in the Go programming language is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to session identifiers...