2231 matches found
Security Bulletin: Session cookie is missing secure attribute and affects IBM Publishing Engine
Summary There is a vulnerability in the session cookie which misses a secure attribute and affects IBM Publishing Engine Vulnerability Details CVEID: CVE-2020-4316 DESCRIPTION: IBM Publishing Engine does not set the secure attribute on authorization tokens or session cookies. Attackers may be abl...
CVE-2020-6292
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration...
Security Bulletin: Session is not invalidated After Logout
Summary IBM Worklight/MobileFoundation has addressed the following vulnerability.The application does not invalidate the validation cookie when the user logs out from the application Vulnerability Details CVEID: CVE-2020-4229 DESCRIPTION: IBM Worklight does not properly invalidate session cookies...
HackerOne: SAML Response Reuse on hackerone.com/users/saml/auth
Summary: When logging in with SAML, the user's IDP authenticates the user and generates a SAML response. The IDP then redirects the user's browser back to HackerOne to submit the SAML response. Upon receiving the SAML response, HackerOne validates it, sets a session cookie in the user's browser,...
CVE-2020-4233
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this...
Information disclosure
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this...
CVE-2020-4233
IBM Security Identity Governance and Intelligence version 5.2.6 is affected by CVE-2020-4233 due to the application not setting the Secure flag on session cookies when using SSL. This allows a remote attacker to capture cookies during HTTP sessions and obtain sensitive information. The issue is d...
Palo Alto Networks PAN-OS 7.1.x < 7.1.26 / 8.0.x < 8.1.13 / 8.1.x < 8.1.13 / 9.0.x < 9.0.6 / 9.1.x < 9.1.1 Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.26 or 8.0.x prior to 8.1.13 or 8.1.x prior to 8.1.13 or 9.0.x prior to 9.0.6 or 9.1.x prior to 9.1.1. It is, therefore, affected by a vulnerability. - A cleartext transmission of sensitive information...
CVE-2020-8434
Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...
CVE-2020-2013
A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama versio...
Design/Logic Flaw
A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama versio...
CVE-2020-2013
CVE-2020-2013 concerns a cleartext transmission vulnerability in Palo Alto Networks PAN-OS Panorama where an authenticated administrator’s PAN-OS session cookie is exposed when performing a context switch to a managed firewall. Technical details in connected documents show affected versions: PAN-...
CVE-2020-2013 PAN-OS: Panorama context switch session cookie disclosure
A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama versio...
PAN-OS: Panorama context switch session cookie disclosure
A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama versio...
Pi-hole < 4.4 - Remote Code Execution / Privileges Escalation Exploit
Exploit for linux platform in category web applications !/usr/bin/env python3 Pi-hole = 4.4 RCE Author: Nick Frichette Homepage: https://frichetten.com Note: This exploit must be run with root privileges and port 80 must not be occupied. While it is possible to exploit this from a non standard...
Pi-hole < 4.4 - Authenticated Remote Code Execution
!/usr/bin/env python3 Pi-hole = 4.4 RCE Author: Nick Frichette Homepage: https://frichetten.com Note: This exploit must be run with root privileges and port 80 must not be occupied. While it is possible to exploit this from a non standard port, for the sake of simplicity and not having to modify...
CVE-2020-12467
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...
CVE-2020-12467
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...