CVE-2022-24189

CVE-2022-24189 affects the Ourphoto App v1.4.1, where the user_token authorization header on /apiv1/* endpoints is not implemented correctly. Removing the header value causes all requests to succeed, bypassing authorization and session management, enabling an attacker to make POST API calls using...

CVE-2022-24189

The usertoken authorization header on the Ourphoto App version 1.4.1 /apiv1/ end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other use...

Shenzhen Fujia Technology OurPhoto 安全漏洞

Shenzhen Fujia Technology OurPhoto is a cloud photo frame software from Shenzhen Fujia Technology, China. It allows you to share photos and video files directly on your cell phone. A security vulnerability exists in Shenzhen Fujia Technology OurPhoto version 1.4.1, which originates from its...

CVE-2022-24189

The usertoken authorization header on the Ourphoto App version 1.4.1 /apiv1/ end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other use...

The vulnerability of the remote access tool for VMware Workspace ONE Assist, related to improper session management, allows a malicious individual to gain unauthorized access to the application.

The vulnerability of the remote access tool for VMware Workspace ONE Assist is related to improper session management. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to the application...

Insufficient Session Expiration

librenms/librenms uses insecure session management. The vulnerability exists due to lack of validate user session user session authentication allows a attacker to bypass authentication...

CVE-2022-40228

IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527...

CVE-2022-40228

CVE-2022-40228 affects IBM DataPower Gateway and is caused by not invalidating active sessions after a password change, which could allow an authenticated user to impersonate another user. Affected versions include 10.0.3.0–10.0.4.0, 10.0.1.0–10.0.1.9, 2018.4.1.0–2018.4.1.22, and 10.5.0.0–10.5.0....

TP-Link TL-WR940N httpd Use of Insufficiently Random Values Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue...

Simmeth System Supplier Manager Session Management Error Vulnerability

Simmeth System Supplier Manager, a supply chain software from Simmeth System, Germany, is vulnerable to a session management error in versions prior to Simmeth System Supplier Manager 5.6. The vulnerability stems from credentials not being cleared from local storage after logging out, which could...

Insecure Session Management

Concrete CMS is vulnerable to insecure sessions management. The vulnerability exists in the attemptAuthentication function in GenericOauthTypeController.php where it does not issue a new session ID upon successful OAuth authentication...

Improper Session Management

rdiffweb is vulnerable to Improper Session Management. The vulnerability exists because the library does not invalidate all the session tokens for a user on a password change, resulting in users logged in with the old password to continue being logged in...

CVE-2022-40845

The Tenda AC1200 Router model W15Ev2 V15.11.0.101576 is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router may be able to expose sensitive information which they're not...

CVE-2022-40843

The Tenda AC1200 V-W15Ev2 V15.11.0.101576 router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of...

CVE-2022-40843

The Tenda AC1200 V-W15Ev2 V15.11.0.101576 router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of...

CVE-2022-40843

The Tenda AC1200 V-W15Ev2 V15.11.0.101576 router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of...

Authorization

The Tenda AC1200 Router model W15Ev2 V15.11.0.101576 is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router may be able to expose sensitive information which they're not...

Simmeth System GmbH Supplier Manager LFI / SQL Injection / Bypass

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: Simmeth System GmbH Supplier manager Lieferantenmanager vulnerable version: 5.6 fixed version: 5.6 CVE number: CVE-2022-44012,...

PT-2022-25576 · Tenda · Tenda Ac1200 Router

Name of the Vulnerable Software and Affected Versions: Tenda AC1200 Router model W15Ev2 version V15.11.0.101576 Description: The issue allows an attacker with access to the router to expose sensitive information they are not explicitly authorized to have, by combining a password exposure...

PT-2022-25574 · Tenda · Tenda Ac1200

Name of the Vulnerable Software and Affected Versions: Tenda AC1200 V-W15Ev2 version V15.11.0.101576 Description: The issue concerns improper authorization and improper session management, allowing the router login page to be bypassed. This enables authenticated attackers to read the router's...