1198 matches found
CVE-2020-13412
The CVE-2020-13412 vulnerability affects Aviatrix Controller prior to 5.4.1204. A web API call did not perform a session token check, enabling Cross-Site Request Forgery (CSRF). The issue originates from inadequate request validation in the web interface, allowing unauthorized actions via forged ...
Topcoder: Blind stored XSS due to insecure contact form at https://www.topcoder.com leads to leakage of session token and other PII
Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://www.topcoder.com/contact-us/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets...
CVE-2020-5894
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
Design/Logic Flaw
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
CVE-2020-5894
The CVE-2020-5894 issue affects NGINX Controller webserver versions 3.0.0–3.3.0. The root cause is that server-side session tokens are not invalidated after logout, enabling a remote attacker who has a valid token to reuse it until it expires. The official advisory indicates that upgrades to 3.4....
CVE-2020-5894
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
CVE-2020-1631 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...
CVE-2020-1631
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...
PT-2020-12873 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.6 Description: The issue arises from the fact that any Cross-Site Request Forgery CSRF token in any user's session can be used in another user's session. Normally, CSRF tokens should be unique to each user's session and...
Security Bulletin: IBM Security Information Queue does not invalidate sessions after logout (CVE-2020-4291)
Summary IBM Security Information Queue ISIQ session identifiers are not properly invalidated upon user logout from ISIQ's web UI. This create opportunities for an attacker to hijack a user session token. As of v1.0.6, ISIQ immediately invalidates the session token when a user logs out...
PT-2020-18345 · Parse · Parse Server
Name of the Vulnerable Software and Affected Versions: parser-server versions prior to 4.1.0 Description: The issue allows fetching all user objects by utilizing regex in the NoSQL query, specifically targeting the sessionToken. This can be achieved through the API endpoint "/parse/users/me" by...
CVE-2020-5393
In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...
CVE-2020-5393
In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...
Cross site scripting
In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...
CVE-2020-5393
CVE-2020-5393 affects Appspace On-Prem (up to 7.1.3). A Cross-Site Scripting (XSS) flaw can enable an attacker to steal session tokens. The CNVD entry for Appspace On-Prem Cross-Site Scripting Vulnerability corroborates the XSS vector, but the provided documents do not specify affected subcompone...
CVE-2020-5393
In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...
CVE-2013-4868
Karotz API 12.07.19.00: Session Token Information Disclosure...
Information disclosure
Karotz API 12.07.19.00: Session Token Information Disclosure...
CVE-2013-4868
CVE-2013-4868 affects Karotz API 12.07.19.00 and is described as a Session Token Information Disclosure. The connected documents confirm the product/version and the impact is information disclosure of session tokens; no root-cause or code-level details are provided in the supplied sources. No exp...