Code injection

In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files...

CVE-2020-5908

Concrete details from connected docs: CVE-2020-5908 affects BIG-IP Edge Client for Linux as shipped in BIG-IP APM 12.1.0–12.1.5 and 11.6.1–11.6.5.2, where the Edge Client logs include the full session ID in local log files, enabling potential disclosure. The F5 advisory (K33023560) notes vulnerab...

F5 Networks BIG-IP : BIG-IP APM Linux Edge Client logging vulnerability (K33023560)

BIG-IP APM Edge Client for Linux exposes the full session ID in the local log files.CVE-2020-5908 Impact This vulnerability may allow unauthorized disclosure of the BIG-IP APM session ID and expose sensitive information to the user of the client device. C Tenable Network Security, Inc. The...

F5 Networks BIG-IP : BIG-IP Edge Client for Windows vulnerability (K15838353)

The BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacyallow attackers to obtain the full session ID from process memory. CVE-2020-5892 Impact An attacker with sufficient local privileges on a client machine running Windows may be able to gain access to the full session...

Session ID does not expire after logout in FortiDeceptor

An insufficient session expiration vulnerability in FortiDeceptor may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2016-11072

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

CVE-2016-11072

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

CVE-2016-11072

Mattermost Server pre-3.0.2 contains a vulnerability where the purposes of a session ID and a Session Token are mishandled. Affected product is Mattermost Server before version 3.0.2. The available connected documents corroborate the issue description but do not provide explicit remediation steps...

CVE-2017-18878

Mattermost Server contains a session-id leakage vulnerability affecting versions before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a valid session ID allows an attacker to revoke another user’s session. This is documented across multiple sources (e.g., Red Hat, SUSE, GHSA advisories) and is not tied t...

Updated ruby-rack packages fix security vulnerability

Updated ruby-rack packages fix security vulnerabilities: There's a possible information leak / session hijack vulnerability in RackRubyGem rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a...

Information Disclosure

centreon/centreon is vulnerable to information disclosure. The session ID is found to be within the server response body, potentially allowing an attacker to obtain the session ID through another vulnerability such as cross-site scripting...

CVE-2020-10945

Centreon before 19.10.7 exposes Session IDs in server responses...

CVE-2020-10945

Centreon before 19.10.7 exposes Session IDs in server responses, constituting an information-disclosure vulnerability. The issue affects Centreon up to version 19.10.6 (prior to 19.10.7) and is confirmed by multiple sources in connected documents. The root cause is exposure of session identifiers...

Palo Alto Networks PAN-OS 7.1.x < 8.1.14 / 8.0.x < 8.1.14 / 8.1.x < 8.1.14 / 9.0.x < 9.0.8 Session Fixation

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.14 or 8.0.x prior to 8.1.14 or 8.1.x prior to 8.1.14 or 9.0.x prior to 9.0.8. It is, therefore, affected by a session fixation vulnerability. - The GlobalProtect Portal feature in PAN-OS does not set a new...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

Code injection

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...

PAN-OS: GlobalProtect Portal PHP session fixation vulnerability

The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. Work around: There are no known workarounds for this issue...

CVE-2020-9502

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...