NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID Clear Text Password Storage

NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID Clear Text Password Storage ''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt + ISR: ApparitionSec...

Gitea < 1.5.3 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if...

CVE-2018-19114

An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindocid value containing the relative pathname of this uploaded file. For example, the...

CVE-2018-19114

MinDoc, up to v1.0.2 , contains an access control flaw: an attacker can escalate privileges by uploading an image containing an admin session and then using a Cookie: mindoc_id with a relative path to that file (e.g., aa/../../uploads/blog/201811/attach_#.jpg). This can grant elevated rights with...

CVE-2018-6434

A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's session ID...

CVE-2018-6434

A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's session ID...

Design/Logic Flaw

A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's session ID...

CVE-2018-6434

The CVE-2018-6434 issue affects Brocade Fabric OS WebGui where the session ID could be intercepted or manipulated via the web management interface on Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, or 7.4.2d. Root cause: insecure handling of session identifiers. Impact per documented sources: po...

Gogs Remote Code Execution Vulnerability

Gogs aka Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team, which supports creating and migrating public/private repositories, adding and removing repository collaborators and so on. A security vulnerability exists in Gogs version 0.11.66, which can be...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18926

CVE-2018-18926: Gitea prior to 1.5.4 is vulnerable to remote code execution due to improper validation of session IDs in the go-macaron/session handling. Affected product is Gitea (Go-based repository server); the root cause is session management logic in Macaron. Public references consistently d...

CVE-2018-18925

Gogs 0.11.66 is vulnerable to remote code execution due to improper validation of session IDs, demonstrated by a ".." session-file forgery in the file.go session provider. The issue stems from session handling in the Macaron-based go-macaron/session code, allowing an attacker to map a crafted ses...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

Design/Logic Flaw

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

Remote code execution

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

MGASA-2018-0428 Updated perl-Dancer2 packages fix security vulnerabilities

Dancer2 0.206000 addresses several potential security issues. There is a potential RCE with regards to Storable. Dancer2 adds session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE. Parsing...

Synology Photo Station Session Fixation Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A session fixation vulnerability exists in SYNO.PhotoStation.Auth in Synology Photo Station versions prior to 6.8.7-3481, which can be exploited by remote attackers to hijack a web session with...