YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF

The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

CVE-2021-29480

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used which is recommended, but is n...

CVE-2021-0269

The improper handling of client-side parameters in J-Web of Juniper Networks Junos OS allows an attacker to perform a number of different malicious actions against a target device when a user is authenticated to J-Web. An attacker may be able to supersede existing parameters, including hardcoded...

Insecure Session Management

cfme2 uses insecure session management. An attacker is able to perform session tampering attacks using the secret in the static secrettoken.rb...

Jira - Insufficient Session Validation Web Vulnerability

Document Title: =============== Jira - Insufficient Session Validation Web Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1970 Video: https://www.youtube.com/watch?v=fCN5EaPiDrk Release Date: ============= 2018-07-23 Vulnerability Laboratory ID VL-ID:...

Code injection

Red Hat CloudForms 2 Management Engine CFME allows remote attackers to conduct session tampering attacks by leveraging use of a static secrettoken.rb secret...

CVE-2013-2049

Red Hat CloudForms 2 Management Engine CFME allows remote attackers to conduct session tampering attacks by leveraging use of a static secrettoken.rb secret...

CVE-2013-2049

CFME/Red Hat CloudForms 2 Management Engine is affected by a vulnerability caused by a static secret_token.rb secret, enabling remote attackers to tamper sessions. Based on provided sources, the impact is session integrity (high for CVSS3) with network access and no authentication; CVSS2/3 base s...

CVE-2013-2049

Red Hat CloudForms 2 Management Engine CFME allows remote attackers to conduct session tampering attacks by leveraging use of a static secrettoken.rb secret...

2: static secret_token.rb value

Red Hat CloudForms 2 Management Engine CFME allows remote attackers to conduct session tampering attacks by leveraging use of a static secrettoken.rb secret...

Apache Struts 2.0.92.1.8 - Session Tampering Security Bypass

Apache Struts 2.0.92.1.8 - Session Tampering Security Bypass source: https://www.securityfocus.com/bid/50940/info Apache Struts is prone to a security-bypass vulnerability that allows session tampering. Successful attacks will allow attackers to bypass security restrictions and gain unauthorized...

Apache Struts 2.0.9/2.1.8 - Session Tampering Security Bypass

source: https://www.securityfocus.com/bid/50940/info Apache Struts is prone to a security-bypass vulnerability that allows session tampering. Successful attacks will allow attackers to bypass security restrictions and gain unauthorized access. Apache Struts versions 2.0.9 and 2.1.8.1 are...