1127 matches found
CVE-2022-36536
An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...
Design/Logic Flaw
An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...
CVE-2022-36536
An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...
CVE-2022-36536
CVE-2022-36536 affects Syncovery for Linux (Super Flexible Software) in the post_applogin.php component. Multiple sources (NVD, Red Hat, CVE lists) describe an insecure session token generation that enables privilege escalation via crafted tokens in v9.47x and earlier. The published CVSS 3.1 base...
Syncovery 安全特征问题漏洞
Syncovery is a superbly versatile synchronization, copy, move, and backup tool from Syncovery Germany. A security vulnerability exists in Syncovery 9 for Linux prior to v9.48j, which stems from session tokens being generated in an insecure manner and can be exploited by an attacker to easily...
CVE-2021-42948: Cleartext Transmission of Sensitive Information
HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's...
HotelDruid 授权问题漏洞
HotelDruid is a hotel management system by the Digitaldruid.net team. The system includes features such as room management, financial management and inventory management. HotelDruid Hotel Management Software version v3.0.3 suffers from an authorization issue vulnerability that stems from the...
PT-2022-4828 · Syncovery · Syncovery
Name of the Vulnerable Software and Affected Versions: Syncovery versions 9.47x and below Description: The issue is related to the component post applogin.php, which allows attackers to escalate privileges via creating crafted session tokens. This is associated with the possibility of decoding a...
CVE-2022-40622
The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...
CVE-2022-40622
The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...
CVE-2022-33738
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...
CVE-2022-33738
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...
Insecure Session
github.com/heroiclabs/nakama is vulnerable to insecure session. The vulnerability exists because session tokens on logout are not properly validated which allows an attacker to send requests with old tokens to authenticate to the application...
PT-2022-21854
Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions prior to 2.11 Description The issue concerns a weak random generator used to create user session tokens for the web portal. This weakness can potentially be exploited, although specific details about real-world...
OpenVPN 安全特征问题漏洞
OpenVPN is a software package for creating encrypted tunnels for virtual private networks VPNs from US-based OpenVPN, which uses the OpenSSL library to encrypt data and control information and allows created VPNs to be authenticated using a public key, e-certificate, or username/password. A...
CVE-2022-2306
Old session tokens can be used to authenticate to the application and send authenticated requests...
CVE-2022-2306
Old session tokens can be used to authenticate to the application and send authenticated requests...
Design/Logic Flaw
Old session tokens can be used to authenticate to the application and send authenticated requests...
