Authentication flaw

In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem...

CVE-2020-4072 Log Forging in generator-jhipster-kotlin

In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem...

CVE-2020-4072

In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem...

Log Forging in generator-jhipster-kotlin

Impact We log the mail for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt...

GHSA-PFXF-WH96-FVJC Log Forging in generator-jhipster-kotlin

Impact We log the mail for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt...

PT-2020-17862

Name of the Vulnerable Software and Affected Versions generator-jhipster-kotlin version 1.6.0 Description The issue allows an attacker to forge log entries by creating log entries for invalid password reset attempts. This can be exploited because the email is provided by a user and the API is...

CVE-2020-4072: Improper Output Neutralization for Logs

In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem...

Shopify: Ability to generate shipping labels in another store orders

Details A shop owner creating a session on its own store on https://mailbox.shopifycloud.com/ service can craft request to print labels on another store he doesn't have access to. Steps to reproduce 1. Go to an unfulfilled order and click on Create a shipping label 2. Copy the CURL request that i...

Hardcoded credentials

Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...

CVE-2020-8434: Session Fixation

Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...

QRadar Community Edition 7.3.1.6 Path Traversal

------------------------------------------------------------------------ QRadar session manager path traversal vulnerability ------------------------------------------------------------------------ Yorick Koster, September 2019...

SIEMENS SINEMA Server Incorrect Session Authentication Vulnerability

SINEMA Server is Siemens' network management software for Industrial Ethernet. A security vulnerability exists in SIEMENS SINEMA Server. An attacker could exploit this vulnerability to compromise the confidentiality, integrity, and availability of affected systems and underlying components...

Multiple Intel Products Session Authentication Vulnerability

The Intel NUC Kit is a small desktop computer from Intel Corporation USA. A session authentication vulnerability exists in the system firmware of multiple Intel products, which originates from a program's failure to perform sufficient session authentication and can be exploited by a local attacke...

F5 Networks BIG-IP : TMM TLS virtual server vulnerability (K10065173)

A BIG-IP virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle MITM attack, despite the attacker not having gained access to t...

CVE-2019-0102

Insufficient session authentication in web server for IntelR Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2019-0102

Insufficient session authentication in web server for IntelR Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

Authentication flaw

Insufficient session authentication in web server for IntelR Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2019-0102

CVE-2019-0102 affects Intel Data Center Manager SDK before version 5.0.2. The flaw is insufficient session authentication in the web server, allowing an unauthenticated user to potentially escalate privileges via network access. CVSS v3 base score 8.8 (vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H...

CVE-2019-0102

Insufficient session authentication in web server for IntelR Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

Fedora 28 : php-symfony (2018-eba0006df2)

Version 2.8.41 2018-05-25 - bug 27359 HttpFoundation Fix perf issue during MimeTypeGuesser intialization nicolas-grekas - security cve-2018-11408 SecurityBundle Fail if security.httputils cannot be configured - security cve-2018-11406 clear CSRF tokens when the user is logged out - security...