CVE-2022-36536

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

Design/Logic Flaw

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

CVE-2022-36536

CVE-2022-36536 affects Syncovery for Linux (Super Flexible Software) in the post_applogin.php component. Multiple sources (NVD, Red Hat, CVE lists) describe an insecure session token generation that enables privilege escalation via crafted tokens in v9.47x and earlier. The published CVSS 3.1 base...

CVE-2022-36536

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

HotelDruid 授权问题漏洞

HotelDruid is a hotel management system by the Digitaldruid.net team. The system includes features such as room management, financial management and inventory management. HotelDruid Hotel Management Software version v3.0.3 suffers from an authorization issue vulnerability that stems from the...

Syncovery 安全特征问题漏洞

Syncovery is a superbly versatile synchronization, copy, move, and backup tool from Syncovery Germany. A security vulnerability exists in Syncovery 9 for Linux prior to v9.48j, which stems from session tokens being generated in an insecure manner and can be exploited by an attacker to easily...

PT-2022-4828 · Syncovery · Syncovery

Name of the Vulnerable Software and Affected Versions: Syncovery versions 9.47x and below Description: The issue is related to the component post applogin.php, which allows attackers to escalate privileges via creating crafted session tokens. This is associated with the possibility of decoding a...

CVE-2022-40622

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

CVE-2022-40622

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

CVE-2022-33738

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

CVE-2022-33738

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

Insecure Session

github.com/heroiclabs/nakama is vulnerable to insecure session. The vulnerability exists because session tokens on logout are not properly validated which allows an attacker to send requests with old tokens to authenticate to the application...

OpenVPN 安全特征问题漏洞

OpenVPN is a software package for creating encrypted tunnels for virtual private networks VPNs from US-based OpenVPN, which uses the OpenSSL library to encrypt data and control information and allows created VPNs to be authenticated using a public key, e-certificate, or username/password. A...

CVE-2022-2306

Old session tokens can be used to authenticate to the application and send authenticated requests...

CVE-2022-2306

Old session tokens can be used to authenticate to the application and send authenticated requests...

Design/Logic Flaw

Old session tokens can be used to authenticate to the application and send authenticated requests...

CVE-2022-2306

CVE-2022-2306 affects heroiclabs/nakama: old session tokens can be used to authenticate to the application, indicating insecure session expiration where logout does not invalidate tokens. The root cause described across connected sources is improper session handling allowing reuse of previously i...

CVE-2022-2306 Insufficient Session Expiration in heroiclabs/nakama

Old session tokens can be used to authenticate to the application and send authenticated requests...

CVE-2022-2306 Insufficient Session Expiration in heroiclabs/nakama

Old session tokens can be used to authenticate to the application and send authenticated requests...

HCL Technologies Traveler Companion 跨站脚本漏洞

HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, India. It is used to read encrypted Hcl Notes emails on Apple devices.A cross-site scripting vulnerability exists in HCL Technologies Traveler Companion version 12.0.1.0 and earlier, which stems from...