PT-2024-13219 · Ibm · Ibm Engineering Lifecycle Optimization - Publishing

Name of the Vulnerable Software and Affected Versions: IBM Engineering Lifecycle Optimization - Publishing versions 7.0.2 through 7.0.3 Description: The issue allows an authenticated user to impersonate another user on the system due to the failure to invalidate session after logout...

PT-2023-3769 · Siemens · Sicam Q200 +1

Name of the Vulnerable Software and Affected Versions: POWER METER SICAM Q100 versions prior to V2.60 Siemens SICAM Q200 affected versions not specified Description: A vulnerability has been identified where affected devices are missing cookie protection flags when using the default settings. Thi...

IBM DataPower Gateway 代码问题漏洞

IBM DataPower Gateway is a suite of International Business Machines IBM security and integration platforms designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and...

PT-2022-22136 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager version 2.0 Description: The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after logout. Recommendations: For IBM Sterling Partn...

CVE-2022-22317

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281...

CVE-2021-45915

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

PT-2022-12465 · Luxsoft · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxSoft LuxCal Web Calendar versions prior to 5.2.0 Description: The issue allows an unauthenticated attacker to manipulate a cookie value, enabling the attacker's session to be authenticated as any registered LuxCal user, including the site...

CVE-2022-1514

Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine...

CVE-2021-3047

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

CVE-2021-3047

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

Authentication flaw

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

CVE-2021-3047

CVE-2021-3047 affects PAN-OS web interface authentication due to a cryptographically weak PRNG. Affected: PAN-OS 8.1.x < 8.1.19, 9.0.x < 9.0.14, 9.1.x < 9.1.10, 10.0.x

CVE-2021-3047

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

CVE-2021-20378

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709...

SAP NetWeaver AS for ABAP Cross-Site Scripting Vulnerability

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver AS for ABAP, which can be exploited by an attacker ...

Zammad SSO Endpoint Authentication Bypass Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An SSO endpoint authentication bypass vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability by creating a valid authentication session to perform any action in the name of another user...

Security Bulletin: Security Vulnerabilities have been fixed in IBM Security Access Manager

Summary Fixes for security vulnerabilities are available for the IBM Security Access Manager product. Vulnerability Details CVEID: CVE-2020-4395 DESCRIPTION: IBM Security Access Manager does not invalidate session after logout which could allow an authenticated user to impersonate another user on...

USN-4539-1 awl vulnerability

Andrew Bartlett discovered that DAViCal Andrew's Web Libraries AWL did not properly manage session keys. An attacker could possibly use this issue to impersonate a session. CVE-2020-11728...

UBUNTU-CVE-2020-11728

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time and the incrementing sessionid can impersonate a session...

PT-2019-17083 · Ibm · Ibm Cloud Private

Name of the Vulnerable Software and Affected Versions: IBM Cloud Private versions 3.1.0 through 3.1.2 Description: The issue allows a local user to impersonate another user on the system because it does not invalidate the session after logout. Recommendations: For versions 3.1.0 through 3.1.2,...