Code injection

UNSUPPPORTED WHEN ASSIGNED Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device...

CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-39452

CVE-2023-39452 affects Socomec MODULYS GP (MOD3GP-SY-120K) web interface. Public documents identify plaintext storage of passwords in the user management section and remote credential exposure due to improper session handling. Affected product details cited by CISA ICS advisory (MODULYS GP-SY-120...

CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-41084 Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking

Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device...

CVE-2023-41084 Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking

Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device...

CVE-2023-41084

Summary: CVE-2023-41084 is a high-severity vulnerability in Socomec MODULYS GP web interface (MOD3GP-SY-120K) caused by incorrect session management that can allow an attacker to steal session cookies and perform actions on the device. Public sources describe a web-only vector with remote exposur...

Socomec MODULYS GP Security Vulnerability

The Socomec MODULYS GP is a green power device from Socomec France. A security vulnerability exists in the Socomec MODULYS GP that stems from incorrect session management in a web application that allows remote access to credentials...

Socomec MODULYS GP Security Vulnerability

The Socomec MODULYS GP is a green power device from Socomec France. A security vulnerability exists in the Socomec MODULYS GP that stems from incorrect session management in a web application, which could allow an attacker to steal a session cookie in order to perform a variety of actions allowed...

PT-2023-5301 · Unknown · Modulys Gp

Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the...

The vulnerability of the Cisco Emergency Responder, Cisco Unified Communications Manager, and Cisco Unified Communications Manager Session Management Edition (SME) systems, as well as the Cisco Unity Connection messaging system, stems from deficiencies in access control. This allows attackers to escalate their privileges.

The vulnerability of the Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition SME, and Cisco Unity Connection systems related to message exchange systems is linked to deficiencies in access control for update files...

PT-2023-5299 · Unknown · Modulys Gp

Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue is related to incorrect session management within the web application, allowing attackers to steal session cookies and perform various actions on the device. Thi...

CVE-2023-41041

Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...

Design/Logic Flaw

Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...

CVE-2023-41041

CVE-2023-41041 concerns Graylog2-server where, in a multi-node cluster, a user session can remain valid for API requests after logout due to per-node session caching. When a user logs out, local caches are cleared and the database may delete the session, but other nodes retain a cached copy, allo...

CVE-2023-20266

A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager Session Management Edition Unified CM SME, and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected...

Cisco多款产品安全漏洞

Cisco Unity Connection UC and others are products of Cisco Corporation.Cisco Unity Connection is a voice messaging platform.Cisco Unified Communications Manager CUCM, Unified CM. Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call processing component of a unified...

Session Fixation

Description Session fixation allows an attacker to impersonate a user by abusing an authenticated session ID SID. This attack can occur when a web application: •Fails to supply a new, unique SID to a user following a successful authentication •Allows a user to provide the SID to be used after...

Vulnerability fixed in Cisco Unified Communications

Cisco has fixed a vulnerability in Unified Communications Manager CM, Unified CM Session Management Edition SME and Unified Communications Manager IM & Presence Service IM&P. A malicious party could exploit the vulnerability to launch a Cross-Site Scripting attack. Such an attack can lead to...

PT-2023-27306 · Unknown · Social Media Skeleton

Name of the Vulnerable Software and Affected Versions: Social media skeleton versions prior to 1.0.5 Description: Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. This issue...