2229 matches found
Information disclosure
An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the sessi...
CVE-2022-25172
An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the sessi...
CVE-2022-25172
The CVE-2022-25172 issue affects InHand Networks InRouter302 (v3.5.4): the web interface session cookie is missing the HttpOnly flag, enabling JavaScript access and exposing the session cookie via XSS. TALOS details confirm this information disclosure vulnerability and show tested version 3.5.4; ...
CVE-2022-25172
An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the sessi...
InHand Networks InRouter302 跨站脚本漏洞
InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. An information disclosure vulnerability exists in InHand Networks InRouter302 V3.5.4, which stems from the lack of the HttpOnly flag in the session cookie, which could be exploited by an attacker to The vulnerabilit...
PT-2022-17111 · Inhand Networks · Inrouter302
Name of the Vulnerable Software and Affected Versions: InHand Networks InRouter302 version 3.5.4 Description: An information disclosure issue exists in the web interface session cookie functionality. The session cookie lacks the HttpOnly flag, making it accessible via JavaScript. This allows an...
CVE-2022-24045
CVE-2022-24045 affects Siemens Desigo DXR2 and PXC series (DXR2 < v01.21.142.5-22; PXC3 < v01.21.142.4-18; PXC4 < v02.20.142.10-10884; PXC5
InHand Networks InRouter302 web interface session cookie information disclosure vulnerability
Summary An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal t...
Rack arbitrary code execution via timing attack
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that doe...
GHSA-XC85-32MF-XPV8 Rack arbitrary code execution via timing attack
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that doe...
SUSE SLES15 / openSUSE 15 Security Update : pgadmin4 (SUSE-SU-2022:1541-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1541-1 advisory. - CVE-2022-0959: Fixed an unrestricted file upload bsc1197143. Tenable has extracted the preceding description block directly...
GHSA-HJP5-HV33-Q58G Plone credentials stored in session cookie
Plone CMS 3.1.x uses invariant data a client username and a server secret when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network...
Plone credentials stored in session cookie
Plone CMS 3.1.x uses invariant data a client username and a server secret when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network...
TerraMaster FS-210信任管理问题漏洞
The Terramaster TerraMaster FS-210 is a NAS Network Attached Storage device from Shenzhen, China-based Terramaster Electronics Technology Terramaster. A security vulnerability exists in Terramaster F4-210, F2-210 TOS version 4.2.X 4.2.15-2107141517, which can be exploited to allow an attacker to...
CVE-2021-45841
In Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517, an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users disabled by default can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest...
FacturaScripts 跨站脚本漏洞
FacturaScripts is an open source ERP software from the individual developer Carlos Garcia in Spain. A cross-site scripting vulnerability exists in NeoRazorX FacturaScripts versions prior to 2022.04, which stems from a lack of filtering and escaping of the title parameter executed on the EditUser...
CVE-2022-28113
An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie...
CVE-2022-28113
An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie...