CVE-2024-37183 Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Information

Plain text credentials and session ID can be captured with a network sniffer...

CVE-2024-37183

Westermo L210-F2G Lynx (CVE-2024-37183) is affected. The vulnerability allows capture of plain text credentials and session IDs over the network due to cleartext transmission. CVSS v3.1 base score 7.5 indicates high severity with Network attack vector and low access complexity; confidentiality im...

CVE-2024-37183 Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Information

Plain text credentials and session ID can be captured with a network sniffer...

PT-2024-27361 · Westermo · L210-F2G Lynx +2

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows plain text credentials and session ID to be captured with a network sniffer. Recommendations: At the moment, there is no information about a newer version that contains a...

CVE-2024-37368

creationtimestamp| type| source ---|---|--- 2024-06-14 17:53:06+00:00| seen| https://t.me/truesecator/5858...

CVE-2024-27176

An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than...

CVE-2024-27176 Remote Code Execution

An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than...

CVE-2024-27176 Remote Code Execution

An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than...

CVE-2024-27176

CVE-2024-27176 affects Toshiba MFP/Toshiba Tec e-STUDIO printers. The root cause is an issue where an attacker can cause Remote Code Execution by overwriting files, enabled by falsifying a session ID variable. The vulnerability is documented as potentially exploitable in combination with other we...

CVE-2024-36128

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of...

TYPO3 frontend login vulnerable to Session Fixation

It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id e.g. by leveraging a...

PT-2024-40453 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue allows attackers to exploit session fixation. When a user authenticates while there is existing anonymous session data, the session id remains unchanged. This enables attackers to...

Apache Tomcat 7.0.0 < 7.0.75

The version of Tomcat installed on the remote host is prior to 7.0.75. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.75security-7 advisory. - A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to...

CVE-2024-35050

An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin...

Brother Printers Multiple Vulnerabilities (Mar 2024)

Multiple Brother printers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2024-35050

An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin...

CVE-2024-35050

An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin...

CVE-2024-35050

CVE-2024-35050 concerns SurveyKing v1.3.1, where an attacker can escalate privileges by re-using a session ID belonging to a user that Admin has deleted. The Red Hat/PT security entries corroborate the same issue and specify SurveyKing 1.3.1 as affected. A practical workaround suggested in PT-202...

CVE-2024-26331

ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass t...

CVE-2024-3411 Insufficient Randomness When Validating an IPMI Authenticated Session

Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device...