164 matches found
CVE-2024-47945
The vulnerability CVE-2024-47945 affects the Rittal IoT Interface & CMC III Processing Unit (prior to version 6.21.00.2). Root cause: insufficient entropy in the session ID generation, with session IDs being predictable (only 32,768 per user) due to use of insecure rand() and missing srand(), so ...
CVE-2024-47945 Predictable Session ID
The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions...
CVE-2024-47945: Generation of Predictable Numbers or Identifiers
The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions...
CVE-2020-1773: Insufficient Entropy
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...
CVE-2014-10400
The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...
PT-2020-7599
Name of the Vulnerable Software and Affected Versions CGILua versions 5.0.x Description The session.lua library uses sequential session IDs, making it easier for remote attackers to predict the session ID and hijack arbitrary sessions. Recommendations For CGILua versions 5.0.x, consider...
CVE-2014-10400: Session Fixation
The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...
CVE-2019-10084: Missing Encryption of Sensitive Data
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit mechanisms. Session and query IDs are unique an...
Information disclosure
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...
CVE-2018-11741
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...
CVE-2018-11741
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...
PT-2018-10798
Name of the Vulnerable Software and Affected Versions NEC Univerge Sv9100 WebPro version 6.00.00 Description The issue concerns Predictable Session IDs, which can lead to Account Information Disclosure. This occurs via specific URIs, such as 'Home.htm?sessionId=&GOTO8'. Recommendations For NEC...
CVE-2018-11741: Exposure of Sensitive Information to an Unauthorized Actor
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...
Moderate severity vulnerability that affects org.springframework:spring-core
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...
GHSA-45VG-2V73-VM62 Moderate severity vulnerability that affects org.springframework:spring-core
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...
CVE-2015-2913
server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict...
CVE-2015-3326
Trend Micro ScanMail for Microsoft Exchange SMEX 10.2 before Hot Fix Build 3318 and 11.0 before Hot Fix Build 4180 creates session IDs for the web console using a random number generator with predictable values, which makes it easier for remote attackers to bypass authentication via a brute force...
PT-2015-6153
Name of the Vulnerable Software and Affected Versions Trend Micro ScanMail for Microsoft Exchange SMEX versions 10.2 before Hot Fix Build 3318 Trend Micro ScanMail for Microsoft Exchange SMEX versions 11.0 before Hot Fix Build 4180 Description The issue allows remote attackers to bypass...
Unspecified Vulnerability in Pivotal Software Spring Framework Java SockJS Client
Pivotal Software Spring Framework is the U.S. Pivotal Software, Inc. of a set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A security vulnerability exists in the Java SockJS client in Pivotal Software Spring Framework version...