The vulnerability of the session verification function of the Cisco Data Center Network Manager (DCNM) allows a attacker to perform an SSRF attack.

The vulnerability of the session verification function in Cisco Data Center Network Manager DCNM is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to perform an SSRF attack remotely...

The vulnerability of Microprogramming Software: Intel Converged Security and Manageability Engine (CSME), Intel Trusted Execution Engine (TXE), and Intel Dynamic Application Loader (DAL) arises from insufficient session verification, allowing attackers to exploit their privileges.

The vulnerability of the Intel Active Management Technology AMT implementation of the Intel Converged Security and Manageability Engine CSME software is related to insufficient session verification. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the `tokenUseGlobalStorage` function in the authentication system for web applications in LemonLDAP::NG allows a attacker to compromise data integrity, gain access to confidential data, and cause service interruptions.

The vulnerability of the tokenUseGlobalStorage function in the authentication system for web applications in LemonLDAP::NG is related to insufficient token session verification. Exploiting this vulnerability could allow a malicious actor to compromise data integrity, gain access to confidential...

The vulnerability of the Intel RAID Web Console 3 web console interface, related to insufficient session verification, allows attackers to escalate their privileges.

The vulnerability of the Intel RAID Web Console 3 RWC3 web console interface is related to insufficient session verification. Exploiting this vulnerability can allow an attacker to gain increased privileges...

systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit Exploit

systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit As documented at , for any action, a polkit policy can specify separate levels of required authentication based on whether a client is: - in an active session on a local console - in an inactive session on...

First look at Tenable.io Web Application Scanner (WAS)

When Tenable firstly announced Web Application Security scanner as a part of their new Tenable.io platform, it was quite intriguing. Certainly, they already had some WAS functionality before in Nessus. For example, path traversal check was pretty good. But this functionality was quite fragmental...

VK.com: Новый 2FA Bypass

Частичный обход проверки сессии. Косяк в функции смены пароля...

CVE-2016-0271

The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors...

Mail.ru: No CSRF token used in Phone Verification POST

When I tried to register in mail.ru,I submitted my phone number and Got a verification code in my phone. During submission of that code,I saw that POST goes without any CSRF tokens.And I identified two other vulnerabilities on that procedure. 1. No Session Verification on server side while...

WordPress Plugin Portable phpMyAdmin - Authentication Bypass

WordPress Plugin Portable phpMyAdmin - Authentication Bypass 'portable-phpMyAdmin WordPress Plugin' Authentication Bypass CVE-2012-5469 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- portable-phpMyAdmin doesn't verify an existing WordPress session...

Network fun online shopping system fashion version 1 0. 3 injection vulnerability-vulnerability warning-the black bar safety net

Network fun online shopping system fashion version 1 0. 3 in the member login to edit an order at the presence ofSQL injection, to cause the administrator password is injected into the storm of the MD5 vulnerability. Vulnerability:file editorderform. asp, the presence ofsql injectionvulnerability...