CVE-2024-47945

The vulnerability CVE-2024-47945 affects the Rittal IoT Interface & CMC III Processing Unit (prior to version 6.21.00.2). Root cause: insufficient entropy in the session ID generation, with session IDs being predictable (only 32,768 per user) due to use of insecure rand() and missing srand(), so ...

CVE-2024-47945 Predictable Session ID

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions...

Rittal IoT Interface & CMC III Processing Unit 安全漏洞

The Rittal IoT Interface & CMC III Processing Unit is a key component of Rittal Germany's Smart Networking of Sensors for monitoring physical environmental conditions. A security vulnerability exists in Rittal IoT Interface & CMC III Processing Unit versions prior to 6.21.00.2, which stems from a...

PT-2024-32907 · Rittal Gmbh & Co. Kg +1 · Iot Interface & Cmc Iii Processing Unit +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, wit...

GHSA-5RXP-2RHR-QWQV Keycloak has session fixation in Elytron SAML adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

GHSA-W8GR-XWP4-R9F7 Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

PT-2024-37046 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions 1.50.3 and prior Description: A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session tok...

CVE-2024-9065 WP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test

The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whpsmtpsendmailtest' function in all versions up to, and including, 4.6.1. This makes it possible for unauthenticated attackers to send emails containing any...

CVE-2024-25285

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2024-25285

...

CVE-2024-25285

...

CVE-2024-25285

CVE-2024-25285 is associated with Redsys 3DSecure 2.0. The vulnerability allows form action hijacking on the threeDSMethod.jsp endpoint, via manipulation of the threeDSMethodNotificationURL or threeDSMethodData parameters, enabling redirection of form submissions to a malicious destination and po...

CVE-2024-45874

A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Vooki.exe...

CVE-2024-45873

A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Yaazhini.exe...

Fedora: Security Advisory (FEDORA-2024-d940f25a53)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-45874

Vulnerability: CVE-2024-45874 affects VegaBird Vooki 5.2.9. Risk arises from DLL hijacking by placing a crafted DLL in the same directory as Vooki.exe, enabling arbitrary code execution and potential persistence. Affected component is the Vooki application (VegaBird Vooki 5.2.9); root cause is lo...

CVE-2024-45873

A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Yaazhini.exe...

VegaBird Vooki 安全漏洞

VegaBird Vooki is a free web application vulnerability scanning tool from VegaBird that helps users to scan any web application and find vulnerabilities.Vooki consists of three main parts: a web application scanner, a Rest API scanner, and a reporting feature. A security vulnerability exists in...

CVE-2024-45873

VegaBird Yaazhini 2.0.2 is affected by a DLL hijacking vulnerability that lets an attacker place a crafted DLL in the Yaazhini.exe directory to execute arbitrary code or maintain persistence. Exploitation involves dropping a DLL (e.g., dcomp.dll) in the application folder and launching Yaazhini.e...