245 matches found
CVE-2021-44160
The CVE refers to Carinal Tien Hospital Health Report System, whose login page authenticates improperly. A remote attacker can modify the cookie parameter to bypass authentication and gain another general user’s privileges, enabling limited system operations or data modification and making the se...
CVE-2021-44160: Authorization Bypass Through User-Controlled Key
Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the...
PT-2021-24054 · Unknown · Carinal Tien Hospital Health Report System
Name of the Vulnerable Software and Affected Versions: Carinal Tien Hospital Health Report System affected versions not specified Description: The system's login page has improper authentication, allowing a remote attacker to acquire another user's privilege by modifying the cookie parameter...
CVE-2021-33842
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located...
CVE-2021-33842: Reliance on Cookies without Validation and Integrity Checking
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located...
PT-2021-20344 · Circutor · Circutor Sge-Plc1000
Name of the Vulnerable Software and Affected Versions: Circutor SGE-PLC1000 version 0.9.2b Description: The issue allows an attacker to perform operations as an authenticated user due to an improper authentication vulnerability in the cookie parameter. To exploit this, the attacker must be within...
FreeBSD : sympa -- Inappropriate use of the cookie parameter can be a security threat. This parameter may also not provide sufficient security. (31a7ffb1-a80a-11eb-b159-f8b156c2bfe9)
Earlier versions of Sympa require a parameter named cookie in sympa.conf configuration file. This parameter was used to make some identifiers generated by the system unpredictable. For example, it was used as following : - To be used as a salt to encrypt passwords stored in the database by the RC...
sympa -- Inappropriate use of the cookie parameter can be a security threat. This parameter may also not provide sufficient security.
Earlier versions of Sympa require a parameter named cookie in sympa.conf configuration file. This parameter was used to make some identifiers generated by the system unpredictable. For example, it was used as following: To be used as a salt to encrypt passwords stored in the database by the RC4...
CVE-2021-25910
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...
Authentication flaw
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...
CVE-2021-25910 ZIV AUTOMATION 4CCT vulnerable to improper authentication
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...
PT-2021-16841
Name of the Vulnerable Software and Affected Versions ZIV AUTOMATION 4CCT-EA6-334126BF affected versions not specified Description The issue concerns an Improper Authentication vulnerability in the cookie parameter, allowing a local attacker to modify several parameters of the affected device as ...
CVE-2021-25910: Improper Authentication
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...
CVE-2021-25910
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...
Shanghai Tsuenlu Software Development Studio Qixing Exam System Exam cookie parameter st*** exists SQL injection vulnerability
Exam System Exam is a compact exam system for internal corporate use for employee exams. Shanghai Tsuen Road Software Development Studio Qixing Exam System Exam candidate side cookie parameter st There is a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive...
CVE-2020-11004
SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute...
CVE-2020-11004: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute...
Security feature bypass
YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability...
PT-2020-7379
Name of the Vulnerable Software and Affected Versions: YaBB versions through 2.5.2 Description: The issue concerns a Local File Include Vulnerability related to the 'guestlanguage' Cookie Parameter. Recommendations: For versions through 2.5.2, update to a version that fixes this issue. At the...