CVE-2022-43398

A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50. Affected devices do not renew the session cookie after login/logout and also accept us...

Authenticated SQL injection via filename & update-instance parameters

There is a SQL injection vulnerability inside saveMeta function in AttachmentAbstract.php. When a file is being uploaded via admin/index.php?action=ajax&ajax=att&ajaxaction=upload endpoint, the filename parameter isn't being sanitized and its later on interpolated into a raw SQL query inside...

Multiple Siemens Products Access Control Error Vulnerabilities

Siemens SICAM is an integrated substation automation system from Siemens Germany. An access control error vulnerability exists in several Siemens products. The vulnerability stems from the fact that the affected device accepts a user-defined session cookie and does not update the session cookie...

PT-2022-20303 · Unknown +2 · Zoneminder +2

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.36.13 Description: The issue allows an attacker to poison a session cookie, which can then be used by the next logged-in user. This can lead to unauthorized access to user accounts. Recommendations: For ZoneMind...

CVE-2022-2783

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token...

CVE-2022-2783

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token...

Cross site request forgery (csrf)

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token...

CVE-2022-2783

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token...

CVE-2022-2783

CVE-2022-2783 affects Octopus Server. A session cookie can be used as a CSRF token, exposing CSRF risk (CVSS v3.1: 5.3, Network vector, Low integrity impact). Multiple sources (NVD, Red Hat, CVE CVE, CVE listing) corroborate; exploitation details are not provided in the connected documents. Red H...

CVE-2022-2783

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token...

PT-2022-18618 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: A security issue was identified in Octopus Server where a session cookie could be used as the CSRF token. Recommendations: At the moment, there is no information about a newer versio...

Octopus Server 跨站请求伪造漏洞

Octopus Server is an automated deployment platform. A cross-site request forgery vulnerability exists in Octopus Server, which stems from the fact that its session cookie can be used as a cross-site request forgery token...

Security Bulletin: SONAS Fix Available for Incomplete Session Termination of SONAS Graphical User Interface (CVE-2013-0497)

Abstract SONAS Graphical User Interface GUI does not invalidate session cookie after logging out of the GUI. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0497 DESCRIPTION: The SONAS GUI generates a session cookie after successful authentication of a SONAS Administrative User. The SONAS GUI doe...

Security Bulletin: IBM Sterling Connect:Direct Browser user interface has multiple vulnerabilities (CVE-2013-0527 and CVE-2013-0529)

Abstract IBM Sterling Connect:Direct Browser is vulnerable to two information disclosure attacks. Content VULNERABILITY DETAILS: CVE ID : CVE-2013-0527 DESCRIPTION: IBM Sterling Connect:Direct Browser is vulnerable to unauthorized information disclosure as a result of C:D Browser pages being left...

GHSA-937F-QH3W-6G87 OctoPrint vulnerable to Insufficient Session Expiration.

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. This issue is fixed in version 1.8.3...

CVE-2022-2888

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

PYSEC-2022-282

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

Code injection

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

PYSEC-2022-282

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

CVE-2022-2888

CVE-2022-2888 describes Insufficient Session Expiration in OctoPrint. If an attacker obtains a victim’s OctoPrint session cookie, they can authenticate as that victim for as long as the account exists. Public docs consistently tie this to the use of a session cookie to authenticate, with impact l...