2172 matches found
Openfind Mail2000 Security Vulnerability
Openfind Mail2000 is a web-based email system from China Netrock Information Openfind. A security vulnerability exists in Openfind Mail2000 that originates from allowing bypassing the HttpOnly flag, which allows an unauthenticated, remote attacker to obtain a session cookie with the HttpOnly flag...
Openfind MailGates and Openfind MailAudit Security Vulnerabilities
Openfind MailGates and Openfind MailAudit are both products of China's Openfind Corporation.Openfind MailGates is an email security system. Openfind MailGates is an email security system that supports email filtering and APT attack defense, etc. Openfind MailAudit is a software for enterprise ema...
PT-2024-37837 · Openfind · Openfind Mail2000
Name of the Vulnerable Software and Affected Versions: Openfind Mail2000 affected versions not specified Description: The issue allows unauthenticated remote attackers to bypass the HttpOnly flag. Attackers can exploit this using specific JavaScript code to obtain the session cookie with the...
CVE-2024-6160 SQL Injection in MegaBIP
SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1...
Siemens SINEC Traffic Analyzer Logic Flaw Vulnerability
SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communication between controllers and IO devices. The software detects PROFINET communication problems and reports them to the user via Web-UI. A logic flaw vulnerability exists in Siemens SINEC Traffic Analyzer,...
CVE-2024-35211
A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes such as “Secure”, “HttpOnly”, or “SameSite”...
CVE-2024-35211
A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes such as “Secure”, “HttpOnly”, or “SameSite”...
CVE-2024-35211
A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes such as “Secure”, “HttpOnly”, or “SameSite”...
CVE-2024-35211
A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes such as “Secure”, “HttpOnly”, or “SameSite”...
CVE-2024-35211
The CVE-2024-35211 issue affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0), all versions prior to V1.2. The underlying flaw is that the web server sets session cookies after login without security attributes (no Secure, HttpOnly, or SameSite), exposing potentially sensitive session data...
Authentication Bypass / Remote Code Execution (RCE)
dtale is vulnerable to Authentication Bypass / Remote Code Execution RCE. The vulnerability is due to improper input validation and the presence of a hardcoded SECRETKEY in the Flask configuration, allowing attackers to forge a session cookie. Additionally, there is improper validation of custom...
Authentication bypass in dtale
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
CVE-2024-3408
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
CVE-2024-3408
CVE-2024-3408 (DTale) affects man-group/dtale 3.10.0 up to 3.15.1. Root causes: (1) hardcoded SECRET_KEY in Flask config enabling session forgery; (2) improper input validation that allows bypass of authentication and arbitrary code execution via the /dtale/update-settings and /dtale/test-filter ...
D-Tale Input Validation Error Vulnerability
Man Group D-Tale is a pandas data structure visualization tool from Man Group, Inc. An input validation error vulnerability exists in D-Tale, which stems from a hard-coded SECRETKEY in the flask configuration, which allows an attacker to forge a session cookie if authentication is enabled...
RHEL 6 : cups (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cups: code execution via unescape ANSI escape sequences CVE-2014-8166 - In macOS High Sierra before...
PT-2024-9179 · Zabbix +4 · Zabbix +4
Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: A bug in the code allows an attacker to sign a forged zbx session cookie, which then allows them to sign in with admin permissions. This issue is related to the authentication mechanism,...
