Palo Alto Networks PAN-OS 7.1.x < 8.1.14 / 8.0.x < 8.1.14 / 8.1.x < 8.1.14 / 9.0.x < 9.0.8 Session Fixation

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.14 or 8.0.x prior to 8.1.14 or 8.1.x prior to 8.1.14 or 9.0.x prior to 9.0.8. It is, therefore, affected by a session fixation vulnerability. - The GlobalProtect Portal feature in PAN-OS does not set a new...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

Code injection

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

PAN-OS: GlobalProtect Portal PHP session fixation vulnerability

The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. Work around: There are no known workarounds for this issue...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

CVE-2020-9502

CVE-2020-9502 affects some Dahua products built before December 2019 where Session IDs are predictable. This allows an attacker, with network access and no authentication or user interaction, to craft data packets to target devices. The available documents consistently describe the issue as predi...

NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration

Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Date: 2020-05-04 Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session Enumeration = $maxproc while pcntlwaitpid0...

CVE-2020-5892

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...

Code injection

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...

CVE-2020-5892

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...

CVE-2020-5892

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...

CVE-2020-5892

CVE-2020-5892 affects the Windows BIG-IP Edge Client components (APM, Edge Gateway, FirePass legacy). The root issue is that an attacker with sufficient local privileges on a client machine could obtain the full session ID from process memory. Affected versions include BIG-IP Edge Client 7.1.5–7....

CVE-2020-10714

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

CVE-2020-11728

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time and the incrementing sessionid can impersonate a session...

CVE-2020-1773

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...

Nagios Log Server Incorrect Access Control Vulnerability

Nagios Log Server is a powerful enterprise-grade log monitoring and management application that allows organizations to quickly and easily view, sort, and configure logs from any source on any given network. An incorrect access control vulnerability exists in Nagios Log Server 2.1.3. An attacker...

CVE-2020-6178

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...

Information disclosure

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...

CVE-2020-6178

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...