Design/Logic Flaw

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

CVE-2019-10045 affects Pydio (web application) up to version 8.2.2, where the action get_sess_id leaks the session cookie value in the HTTP response body. This enables a script to access the session identifier and potentially impersonate a user if a session is active. The issue is a result of lea...

EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2019-1622)

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to...

EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1605)

According to the version of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web...

EulerOS 2.0 SP2 : cups (EulerOS-SA-2019-1566)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - CUPS printing system provides a portable printing layer for UNIXAr operating systems. It has been developed by Apple Inc.to promote a standard...

EulerOS 2.0 SP3 : cups (EulerOS-SA-2019-1567)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - CUPS printing system provides a portable printing layer for UNIXAr operating systems. It has been developed by Apple Inc.to promote a standard...

EulerOS 2.0 SP5 : cups (EulerOS-SA-2019-1568)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - CUPS printing system provides a portable printing layer for UNIXAr operating systems. It has been developed by Apple Inc.to promote a standard...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability

The version of Fortinet FortiClient running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if...

CVE-2018-7064

A reflected cross-site scripting XSS vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session...

Cross site scripting

A reflected cross-site scripting XSS vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session...

CVE-2018-7064

CVE-2018-7064 describes a reflected cross-site scripting (XSS) vulnerability in an unauthenticated Aruba Instant web interface. An attacker could lure an IAP administrator into a malicious link to perform administrative actions on the Instant cluster or to exfiltrate the admin session cookie. The...

CVE-2018-7064

A reflected cross-site scripting XSS vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session...

EulerOS Virtualization 2.5.3 : cups (EulerOS-SA-2019-1352)

According to the version of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web...

keycloak: session hijack using the user access token

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

Cross-Site Scripting (XSS)

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Session Fixation

Cumin is vulnerable to session fixation. An authenticated remote attacker is able to steal the victim's session after they log into Cumin via a crafted session cookie...

CVE-2019-3868

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...