Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)

Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Title: Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Author: Cakes Exploit Date: 2018-08-01 Vendor: Vox Telecom Link: https://www.vox.co.za/ Firmware Version: 6.2.W.1 CVE: N/A Description Due to improper session managemen...

Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for hardware platform in category web applications Title: Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Author: Cakes Vendor: Vox Telecom Link: https://www.vox.co.za/ Firmware Version: 6.2.W.1 Description Due to improper session management low privilege users are able to...

Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)

Title: Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Author: Cakes Exploit Date: 2018-08-01 Vendor: Vox Telecom Link: https://www.vox.co.za/ Firmware Version: 6.2.W.1 CVE: N/A Description Due to improper session management low privilege users are able to create administrator accoun...

CVE-2018-10140

CVE-2018-10140 affects PAN-OS PAN-OS Management Web Interface. The issue is a Denial of Service where an authenticated user can cause all management sessions to shut down and be redirected to login. Affected: PAN-OS 8.1.2 and earlier. Not affected: PAN-OS 6.1, 7.1, and 8.0. The threat is triggere...

Design/Logic Flaw

Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password...

CVE-2016-6545

CVE-2016-6545 relates to iTrack Easy where session cookies are not used to maintain valid sessions and the user password is sent as a base64-encoded POST parameter on every request. The underlying issue is insufficient session expiration/management, requiring a password change to terminate sessio...

APSB18-22 Security update available for Adobe Connect

Adobe has released a security update for Adobe Connect. This update resolves an important authentication bypass vulnerability CVE-2018-4994, which could result in sensitive information disclosure if successfully exploited. This update also resolves an important session management vulnerability du...

CloudBees Jenkins SAML PluginHTTP Session Fixation Vulnerability

CloudBees Jenkins is a Java-based continuous integration tool from CloudBees, Inc. that is used to monitor ongoing software releases/testing projects and timed tasks.SAML Plugin is a plugin that supports authentication to Jenkins using the SAML 2.0 protocol. SAML Plugin A session fixation...

Security Bulletin: API Connect is affected by a session management vulnerability (CVE-2018-1532)

Summary API Connect has addressed the following vulnerability. IBM API Connect does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. Vulnerability Details CVEID: CVE-2018-1532 DESCRIPTION: IBM API Connect does no...

The vulnerability of SAP Business Objects software for data collection and analysis lies in improper session management, allowing attackers to gain unauthorized access.

The vulnerability of SAP Business Objects software for data collection and analysis is related to improper session management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access...

CVE-2017-6779

Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service DoS condition. The vulnerability occu...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

Design/Logic Flaw

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

Design/Logic Flaw

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-9091

A critical vulnerability in the KEMP LoadMaster Operating System LMOS 6.0.44 through 7.2.41.2 and Long Term Support LTS LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated...

Security feature bypass

A critical vulnerability in the KEMP LoadMaster Operating System LMOS 6.0.44 through 7.2.41.2 and Long Term Support LTS LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated...

CVE-2018-9091

A critical vulnerability in the KEMP LoadMaster Operating System LMOS 6.0.44 through 7.2.41.2 and Long Term Support LTS LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...