53 matches found
CVE-2021-32424
In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the route...
CVE-2020-26552: Undefined Security Weakness
An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a valid session ID for access...
CVE-2020-13416
An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery CSRF vulnerability for password resets...
CVE-2019-18418
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management...
The vulnerability of the Jenkins automation server, related to the absence of a web session identifier, allows attackers to perform cross-site forgery attacks and gain unauthorized access to protected information.
The vulnerability of the Jenkins automation server relates to the absence of a web session identifier. Exploiting this vulnerability allows a malicious actor to perform cross-site fraudulently and gain unauthorized access to protected information...
CVE-2018-10285: Incorrect Permission Assignment for Critical Resource
The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authentication...
The vulnerability of the Vesta Control Panel server’s control panel lies in the lack of checking for the presence of a user session. This allows attackers to perform various manipulations on files and directories located on the server.
The vulnerability of the Vesta Control Panel’s control panel lies in the lack of checking for the presence of a user session in the files.php file web/file-manager/, which is responsible for the operation of the control panel’s file manager. Exploiting this vulnerability allows an attacker to...
The vulnerability of the ZyXEL PMG5318-B20A router allows a violator to circumvent existing access restrictions.
The vulnerability of the ZyXEL PMG5318-B20A router exists due to the absence of session termination after exiting the system. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using an automated workstation...
OpenFiler 2.99.1 - CSRF Vulnerability
Exploit for php platform in category web applications DoS 0day.today 2018-03-28...
OpenFiler 2.99.1 - Cross-Site Request Forgery
OpenFiler 2.99.1 - Cross-Site Request Forgery DoS...
Tomcat/JBoss Web - Bypass of CSRF prevention filter
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...
CVE-2007-2170: Undefined Security Weakness
The APPLSYS.FNDDMNODES package in Oracle E-Business Suite does not check for valid sessions, which allows remote attackers to delete arbitrary nodes. NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126,...