CVE-2016-11072

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

CVE-2016-11072

Mattermost Server pre-3.0.2 contains a vulnerability where the purposes of a session ID and a Session Token are mishandled. Affected product is Mattermost Server before version 3.0.2. The available connected documents corroborate the issue description but do not provide explicit remediation steps...

CVE-2017-18878

Mattermost Server contains a session-id leakage vulnerability affecting versions before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a valid session ID allows an attacker to revoke another user’s session. This is documented across multiple sources (e.g., Red Hat, SUSE, GHSA advisories) and is not tied t...

Updated ruby-rack packages fix security vulnerability

Updated ruby-rack packages fix security vulnerabilities: There's a possible information leak / session hijack vulnerability in RackRubyGem rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a...

Information Disclosure

centreon/centreon is vulnerable to information disclosure. The session ID is found to be within the server response body, potentially allowing an attacker to obtain the session ID through another vulnerability such as cross-site scripting...

CVE-2020-10945

Centreon before 19.10.7 exposes Session IDs in server responses...

CVE-2020-10945

Centreon before 19.10.7 exposes Session IDs in server responses, constituting an information-disclosure vulnerability. The issue affects Centreon up to version 19.10.6 (prior to 19.10.7) and is confirmed by multiple sources in connected documents. The root cause is exposure of session identifiers...

Palo Alto Networks PAN-OS 7.1.x < 8.1.14 / 8.0.x < 8.1.14 / 8.1.x < 8.1.14 / 9.0.x < 9.0.8 Session Fixation

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.14 or 8.0.x prior to 8.1.14 or 8.1.x prior to 8.1.14 or 9.0.x prior to 9.0.8. It is, therefore, affected by a session fixation vulnerability. - The GlobalProtect Portal feature in PAN-OS does not set a new...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

Code injection

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

PAN-OS: GlobalProtect Portal PHP session fixation vulnerability

The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. Work around: There are no known workarounds for this issue...

CVE-2020-9502

CVE-2020-9502 affects some Dahua products built before December 2019 where Session IDs are predictable. This allows an attacker, with network access and no authentication or user interaction, to craft data packets to target devices. The available documents consistently describe the issue as predi...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration

Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Date: 2020-05-04 Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session Enumeration = $maxproc while pcntlwaitpid0...

CVE-2020-5892

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...

Code injection

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...

CVE-2020-5892

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory...

CVE-2020-5892

CVE-2020-5892 affects the Windows BIG-IP Edge Client components (APM, Edge Gateway, FirePass legacy). The root issue is that an attacker with sufficient local privileges on a client machine could obtain the full session ID from process memory. Affected versions include BIG-IP Edge Client 7.1.5–7....