Kartpay: Being able to change account contents even after password change

Improper Handling of Sessions leads to this vulnerability where users can try to login with 2 different sessions in 2 different browsers. changing any data doesn't reflect all the logged-in sessions...

Cisco Data Center Network Manager < 11.1(1) Authentication Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper session...

The vulnerability of the vCloud Director platform, related to improper session management, allows a attacker to intercept deleted sessions.

The vulnerability of the vCloud Director platform vCD is related to improper session management. Exploiting this vulnerability can allow a malicious actor to intercept disconnected sessions remotely...

The vulnerability of the built-in software in Intel NUC Kits relates to improper session management. This allows attackers to gain access to protected information, cause system failures, or enhance their privileges.

The vulnerability of the built-in software in the Intel NUC Kit is related to improper session management. Exploiting this vulnerability can allow an attacker to access protected information, cause service failures, or increase their privileges...

PT-2018-9010

Name of the Vulnerable Software and Affected Versions Denbun by NEOJAPAN Inc. versions V3.3P R4.0 and earlier Denbun by NEOJAPAN Inc. versions V3.3I R4.0 and earlier Description The issue is related to improper session management, which allows remote attackers to read or send mail, or change the...

UBUNTU-CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery (Add Admin) Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery Add Admin Author: Cakes Vendor Homepage: http://www.netis-systems.com Software Link: http://www.netis-systems.com/Home/detail/id/74.html Tested Version: RTK...

Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery (Add Admin)

Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery Add Admin Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery Add Admin Author: Cakes Discovery Date: 2018-10-01 Vendor Homepage: http://www.netis-systems.com Software Link:...

Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery Add Admin Author: Cakes Discovery Date: 2018-10-01 Vendor Homepage: http://www.netis-systems.com Software Link: http://www.netis-systems.com/Home/detail/id/74.html Tested Version: RTK 2.1.1 Tested on OS: Kali Linux CV...

Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)

Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Title: Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Author: Cakes Exploit Date: 2018-08-01 Vendor: Vox Telecom Link: https://www.vox.co.za/ Firmware Version: 6.2.W.1 CVE: N/A Description Due to improper session managemen...

Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)

Title: Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Author: Cakes Exploit Date: 2018-08-01 Vendor: Vox Telecom Link: https://www.vox.co.za/ Firmware Version: 6.2.W.1 CVE: N/A Description Due to improper session management low privilege users are able to create administrator accoun...

The vulnerability of SAP Business Objects software for data collection and analysis lies in improper session management, allowing attackers to gain unauthorized access.

The vulnerability of SAP Business Objects software for data collection and analysis is related to improper session management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access...

CVE-2018-11714

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of...

CVE-2018-11714

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of...

CVE-2018-11714

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

CVE-2018-2408

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

Input validation

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

CVE-2018-2409

The CVE-2018-2409 issue affects SAP Cloud Platform 2.0 components (Connectivity Service and Cloud Connector). The root cause is improper session management, which can allow data from another user to be shown or modified when applications built on SAP Cloud Platform are used. In practice, this lea...