Design/Logic Flaw

On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic...

CVE-2019-6590

On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic...

CVE-2019-6590

CVE-2019-6590 affects BIG-IP LTM (TMM) where SSL Session ID Persistence processing can trigger excessive resource use, leading to a denial-of-service. Affected: BIG-IP LTM 13.0.0–13.0.1 and 12.1.0–12.1.3.6. Root cause: TMM resource exhaustion under certain conditions. Impact: potential memory exh...

F5 Networks BIG-IP : TMM vulnerability (K55101404)

Under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic. CVE-2019-6590 Impact BIG-IP This vulnerability may result as a denial-of-service DOS attack on the affected BIG-IP systemwhen the systemconsumes excessive memory resources. This...

Information Disclosure

Tomcat is vulnerable to information disclosure. It is possible because it does not prevent the leveraging use of requestedSessionSSL field, allowing the reuse of the same session ID for the next request using that Request object. The vulnerability is not easy to set up as the client because it...

Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation Exploit

Exploit for windows platform in category local exploits Windows: SSPI Network Authentication Session 0 EoP Platform: Windows 10 1803/1809 not tested earlier versions Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: Session boundary Summary: Performing an NTLM...

PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting

PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS Date: 21/12/2018 Exploit Author: Kumar Saurav Reference: https://0dayfindings.home.blog/2018/12/26/plc-wireless-router-gpn2-4p21-c-cn-reflected-xss/ Vendor: ChinaMobile...

PLC Wireless Router GPN2.4P21-C-CN Cross Site Scripting Vulnerability

Exploit for cgi platform in category web applications Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS Exploit Author: Kumar Saurav Vendor: ChinaMobile Category: Hardware Version: GPN2.4P21-C-CN Firmware: W2001EN-00 Tested on: Multiple CVE : CVE-2018-20326 Description: PLC Wireles...

NEC Univerge Sv9100 WebPro 6.00.00 Predictable Session ID / Cleartext Passwords

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt + ISR: ApparitionSec Greetz: indoushka | Eduardo B. 0day Vendor www.necam.com Affected Product Code Base NEC Univerge...

NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID Clear Text Password Storage

NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID Clear Text Password Storage ''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt + ISR: ApparitionSec...

NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage

''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt + ISR: ApparitionSec Greetz: indoushka | Eduardo B. 0day Vendor www.necam.com Affected Product Code Base NEC...

NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage

Exploit for hardware platform in category web applications ''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt + ISR: ApparitionSec Greetz: indoushka | Eduardo B...

Gitea < 1.5.3 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if...

CVE-2018-19114

An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindocid value containing the relative pathname of this uploaded file. For example, the...

CVE-2018-19114

MinDoc, up to v1.0.2 , contains an access control flaw: an attacker can escalate privileges by uploading an image containing an admin session and then using a Cookie: mindoc_id with a relative path to that file (e.g., aa/../../uploads/blog/201811/attach_#.jpg). This can grant elevated rights with...

CVE-2018-6434

A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's session ID...

CVE-2018-6434

A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's session ID...

Design/Logic Flaw

A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's session ID...

CVE-2018-6434

The CVE-2018-6434 issue affects Brocade Fabric OS WebGui where the session ID could be intercepted or manipulated via the web management interface on Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, or 7.4.2d. Root cause: insecure handling of session identifiers. Impact per documented sources: po...

Gogs Remote Code Execution Vulnerability

Gogs aka Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team, which supports creating and migrating public/private repositories, adding and removing repository collaborators and so on. A security vulnerability exists in Gogs version 0.11.66, which can be...