CVE-2023-35794: Improper Authentication

An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint spawned console can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console...

Fedora 37 : firefox (2023-4e191bea36)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4e191bea36 advisory. - Update to latest upstream 119.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

PT-2023-25318 · Cassia · Cassia Access Controller

Name of the Vulnerable Software and Affected Versions: Cassia Access Controller version 2.1.1.2303271039 Description: An issue was discovered in the Cassia Access Controller where the Web SSH terminal endpoint, also known as the spawned console, can be accessed without proper authentication. The...

Socomec MOD3GP-SY-120K

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION : Exploitable remotely/low attack complexity Vendor : Socomec Equipment : MOD3GP-SY-120K Vulnerabilities : Cross-Site Scripting XSS, Cross-Site Request Forgery CSRF, Insecure Storage of Sensitive Information, Reliance on Cookies without Validation and...

CVE-2023-32612: Reliance on Cookies without Validation and Integrity Checking

Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege...

PT-2023-22736

Name of the Vulnerable Software and Affected Versions TMT Lockcell versions prior to 15 Description The issue is related to the reliance on cookies without validation and integrity checking in a security decision, which allows for privilege abuse and authentication bypass. Recommendations For...

CVE-2023-3050: Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass. This issue affects Lockcell: before 15...

CVE-2022-3083

All versions of Landis+Gyr E850 ZMQ200 are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie...

CVE-2022-3083

All versions of Landis+Gyr E850 ZMQ200 are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie...

CVE-2022-3083

CVE-2022-3083 affects all versions of Landis+Gyr E850 (ZMQ200). The vulnerability is CWE-784: Reliance on Cookies Without Validation and Integrity, where web application navigation depends on the session cookie value; an attacker changing cookie values could render the web interface inaccessible....

PT-2023-13020 · Landis+Gyr · Landis+Gyr E850

Name of the Vulnerable Software and Affected Versions: Landis+Gyr E850 ZMQ200 versions all Description: The device's web application navigation depends on the value of the session cookie. If an attacker changes the session cookie values, the web application could become inaccessible for the user...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)

The version of AOS installed on the remote host is prior to 5.17.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.17.1 advisory. - When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat trea...

CVE-2022-35284: Reliance on Cookies without Validation and Integrity Checking

IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811...

CVE-2022-30623

The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password...

CVE-2022-30620: Reliance on Cookies without Validation and Integrity Checking

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...

Chcnav P5E GNSS 授权问题漏洞

Chcnav P5E GNSS is a Global Positioning System from Chcnav. A security vulnerability exists in Chcnav P5E GNSS that stems from an error in the way user cookies are checked, which can be exploited by an attacker to bypass system identification using a username and password...

CVE-2022-1148: Reliance on Cookies without Validation and Integrity Checking

Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the...

CVE-2020-4879

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...

CVE-2020-4879

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...

CVE-2021-42338

4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files...