Hardcoded credentials

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time and the incrementing sessionid can impersonate a session...

CVE-2020-11728

CVE-2020-11728 affects DAViCal Andrew's Web Libraries (AWL) up to version 0.60. The flaw is weak session management: session keys are not hard-to-guess, enabling impersonation via guessed microsecond time and incrementing session_id. Debian/DSA-4660-1 and USN-4539-1 describe fixed versions (e.g.,...

CVE-2020-11728

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time and the incrementing sessionid can impersonate a session...

CVE-2020-11728

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time and the incrementing sessionid can impersonate a session...

Improper Session Management

php is vulnerable to improper session management. The vulnerability exists as a previous security update introduced a bug into PHP session cookie handling. This could allow an attacker to stop a victim from viewing a vulnerable web site if the victim has first visited a malicious web page under t...

CVE-2020-4253

CVE-2020-4253 affects IBM Content Navigator 3.0CD, where the session is not invalidated after logout, allowing an authenticated user to impersonate another user. Root cause: session remains active post-logout. Affected product/version: IBM Content Navigator 3.0CD (IBM bulletin also lists remediat...

Security Bulletin: IBM Content Navigator is vulnerable to a session management vulnerability.

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4253 DESCRIPTION: IBM Content Navigator does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. CVSS Base score: 6.3...

Astra - Automated Security Testing For REST API's

REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can automatically...

CVE-2020-5543

TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allows remote attackers to stop the network functions or execute malware via a specially crafted packet...

CVE-2020-10575

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

DEBIAN-CVE-2020-10575

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

CVE-2020-10575

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

CVE-2020-10575

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

UBUNTU-CVE-2020-10575

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

Race condition

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

CVE-2020-10575

CVE-2020-10575 affects the Janus WebRTC server (VideoCall plugin) up to version 0.9.1. The issue is a race condition in plugins/janus_videocall.c that mishandles session management, causing references to be freed too early or too many times. This is stated consistently across sources including Re...

CVE-2020-10575

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

CVE-2020-10575

An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...

Cisco FTD Software Pluggable Authentication Module DoS (cisco-sa-20191002-ftd-fpmc-dos)

According to its self-reported version, Cisco Firepower Threat Defense FTD Software is affected by a vulnerability in the configuration of the Pluggable Authentication Module PAM due to improper resource management in the context of user session management. An authenticated, remote attacker can...

The vulnerability of the web interface of Belden Hirschmann’s network switches models RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS allows a intruder to gain unauthorized access and intercept web sessions.

The vulnerability of Belden Hirschmann’s network switch web interfaces for models series RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS is related to improper session management. Exploiting this vulnerability can allow an attacker to gain unauthorized access and intercept web sessions...