2895 matches found
CVE-2020-9055: Improper Neutralization of Input During Web Page Generation
Versiant LYNX Customer Service Portal CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or...
ZendTo Elevation of Privilege Vulnerability
ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. An elevation of privilege vulnerability exists in versions prior to ZendTo 5.22-2 Beta. The vulnerability stems from lib/NSSDropbox.php in ZendTo failing to...
CVE-2020-8986
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...
CVE-2020-8986
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...
Code injection
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...
CVE-2020-8986
CVE-2020-8986 affects ZendTo prior to 5.22-2 Beta. The issue is in lib/NSSDropbox.php where equality is not correctly checked when validating the session cookie, enabling an attacker to gain administrative access with a large number of requests. The Red Hat/NVD entries corroborate the impact and ...
CVE-2020-8986
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...
PT-2020-20409
Name of the Vulnerable Software and Affected Versions ZendTo versions prior to 5.22-2 Beta Description The issue is related to the lib/NSSDropbox.php file in ZendTo, where it failed to properly check for equality when validating the session cookie. This allows an attacker to gain administrative...
CVE-2020-8986: Improper Check for Unusual or Exceptional Conditions
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...
Security Bulletin: WebSphere DataPower XC10 Appliance vulnerabilities exist in the administrative console and session cookie at login (CVE-2014-3059 and CVE 2014-2060)
Summary In certain configurations, a security vulnerability exists in WebSphere DataPower XC10 Appliance. A WebSphere eXtreme Scale attacker could gain administrative access to the device. Vulnerability Details VULNERABILITY DETAILS: CVEID: CVE-2014-3059 In certain configurations, a security...
Denial of service
An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...
CVE-2019-19611
An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...
PT-2020-10198
Name of the Vulnerable Software and Affected Versions Halvotec RaQuest versions prior to 10.24.11206.1 Description An issue was discovered that allows an anonymous user to access the list of connected users as well as the session cookie for each user through one of the exposed web services...
CVE-2019-19611: Undefined Security Weakness
An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...
Pandora FMS Ping Authenticated Remote Code Execution
This module exploits a vulnerability found in Pandora FMS 7.0NG and lower. nettools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands. Module Options msf use exploit/linux/http/pandora/pingcmdexec msf undefinedpingcmdexec show actions ...actions... msf...
CVE-2020-9449
CVE-2020-9449 affects BlaB! AX/AX Pro and BlaB! WS clients (version 19.11) due to insecure RNG. An attacker with a guest or user session cookie can retrieve the cookie salt value and craft a valid session cookie to escalate privileges to other users or admin. Root cause: weak/random generation in...
CVE-2020-9449
An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS client, and BlaB! WS Pro client version 19.11 allows an attacker with a guest or user session cookie to escalate privileges by retrieving the cookie salt value and creating a valid session cookie for an arbitra...
PT-2020-20667
Name of the Vulnerable Software and Affected Versions BlaB! AX version 19.11 BlaB! AX Pro version 19.11 BlaB! WS client version 19.11 BlaB! WS Pro client version 19.11 Description An insecure random number generation issue allows an attacker with a guest or user session cookie to escalate...
TopManage OLK Elevation of Privilege Vulnerability
TopManage OLK is a suite of e-commerce management solutions from TopManage Panama. A security vulnerability exists in TopManage OLK version 2020, which stems from the program's failure to set ReadOnly for session cookies, and can be exploited by an attacker to compromise user and administrator...