Insecure Cryptographic Function

mautic/core has insecure cryptographic function. An attacker may exploit the pseudorandomness of the function mtrand and enumerate session tokens...

CVE-2021-27913

The function mtrand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under...

CVE-2021-27913

The function mtrand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under...

CVE-2021-27913

The CVE-2021-27913 issue is due to using PHP’s mt_rand to generate session tokens, which is cryptographically insecure and can enable enumeration of session tokens. Affected software is Mautic, specifically versions prior to 3.3.4 and versions prior to 4.0.0. The root cause is reliance on a non-c...

PT-2021-17667

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0 Description: The function mt rand is used to generate session tokens, which is cryptographically flawed due to its pseudorandom nature. An attacker can exploit this flaw to enumera...

Mautic 安全特征问题特征问题漏洞

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. mautic versions prior to 3.3.4 and versions prior to 4.0.0 are vulnerable to a security feature issue that stems from the mtrand function in the softwar...

CVE-2021-27913: Use of a Broken or Risky Cryptographic Algorithm

The function mtrand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under...

Cross-site Scripting (XSS) - Reflected in znixbtw/panel-v2

✍️ Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will...

Revive Adserver: Use of a Broken or Risky Cryptographic Algorithm

revive-adserver utilizes a PRNG for session-token generation, this means that an attacker could theoretically be able to generate session tokens at random and take over accounts at random. This function does not generate cryptographically secure values, and should not be used for cryptographic...

CVE-2021-22676

UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting XSS, which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA...

Use of a Broken or Risky Cryptographic Algorithm in mautic/mautic

✍️ Description The function mtrand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are...

U.S. Dept Of Defense: Cross site scripting

Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. Impact Malicious...

Claroty Secure Remote Access 安全漏洞

Claroty Secure Remote Access is a core component of the Claroty Platform from Claroty, Inc. that provides frictionless, reliable and highly secure remote access for OT environments. A security vulnerability exists in Claroty Secure Remote Access that allows them to generate valid session tokens f...

Exposed Session Token

Web applications use sessions to retain information about each user, keep track of their activity or define proper access rights and permissions. Each session has an identifier token or ID defined by the application to bind users to their HTTP traffic, being temporarily equivalent to the stronges...

Versa VOS 授权问题漏洞

Versa Networks VOS is an operating system from Versa Networks, USA. The highly flexible VOS enables enterprises, organizations and service providers to deploy Versa SASE in branch offices, clouds, campuses and data centers. A security vulnerability exists in Versa VOS that stems from the fact tha...

Sifchain: Session Token in URL

Hello Sifchain Finance Team - Greetings to you! Hope you are well and safe. MAIN URL - https://sifchain.finance/master/ URL That has to be fixed -...

Trend Micro IM Security Weak Session Token Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Trend Micro IM Security. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 16373 by default. The issue results fr...

U.S. Dept Of Defense: [www.█████] Path-based reflected Cross Site Scripting

Description: The www.██████ endpoint is vulnerable to path-based reflected XSS which allows attackers to pass rogue JavaScript to unsuspecting users. Impact This flaw allows attackers to pass rogue JavaScript to unsuspecting users. Since the user’s browser has no way to know the script should not...

CVE-2021-27945

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting XSS vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who...

Cross site scripting

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting XSS vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who...