Multiple vulnerabilities in TCP/IP function on Mitsubishi Electric GOT2000 series

Overview TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series GT27, GT25, and GT23 contains multiple vulnerabilities listed below. Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119 - CVE-2020-5595 Session Fixation CWE-384 - CVE-2020-5596 NUL...

Mitsubishi Electric GOT2000 Series

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: GOT2000 Series Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Session Fixation, NULL Pointer Dereference, Improper Access...

MySQL Enterprise Monitor 4.0.11.x < 4.0.12.5341 / 8.0.18.x < 8.0.20.1227(Apr 2020 CPU)

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 4.0.11.x prior to 4.0.12.5341 or 8.0.18.x prior to 8.0.20.1227. It is, therefore, affected by a session fixation vulnerability. An unauthenticated, remote attacker could exploit this to...

CVE-2020-15018

playSMS through 1.4.3 is vulnerable to session fixation...

CVE-2020-15018

playSMS through 1.4.3 is vulnerable to session fixation...

CVE-2020-15018

playSMS through 1.4.3 is vulnerable to session fixation...

Session fixation

playSMS through 1.4.3 is vulnerable to session fixation...

CVE-2020-15018

CVE-2020-15018 affects playSMS up to version 1.4.3 and is described as vulnerable to session fixation. Connected sources indicate an attacker could leverage this issue to establish or hijack a user session and take control of a user’s account, implying impact to authentication/session integrity. ...

CVE-2020-15018

playSMS through 1.4.3 is vulnerable to session fixation...

Session fixation

An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2020-1645)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections ...

Session fixation

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...

A cyber warning light. The canary in the mine

One of the most difficult challenges for any sector is trying to alert an audience without skills in ‘cyber’ to the presence of unusual activity that might suggest a hack or other security tampering. What if we could alert a ship’s captain, an airplane pilot, car driver or machine operator that...

[SECURITY] [DLA 2209-1] tomcat8 security update

Package : tomcat8 Version : 8.0.14-1+deb8u17 CVE ID : CVE-2019-17563 CVE-2020-1935 CVE-2020-1938 CVE-2020-9484 Debian Bug : 961209 952436 952437 952438 Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. WARNING: The fix for CVE-2020-1938 may disrupt servic...

SUSE-SU-2020:1498-1 Security update for tomcat

This update for tomcat fixes the following issues: CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a...

SUSE-SU-2020:1497-1 Security update for tomcat

This update for tomcat fixes the following issues: CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a...

Palo Alto Networks PAN-OS 7.1.x < 8.1.14 / 8.0.x < 8.1.14 / 8.1.x < 8.1.14 / 9.0.x < 9.0.8 Session Fixation

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.14 or 8.0.x prior to 8.1.14 or 8.1.x prior to 8.1.14 or 9.0.x prior to 9.0.8. It is, therefore, affected by a session fixation vulnerability. - The GlobalProtect Portal feature in PAN-OS does not set a new...

rConfig <= 3.9.5 Multiple Vulnerabilities

rConfig is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-12258

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259...

CVE-2020-12258

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259...