CVE-2023-45281

CVE-2023-45281 affects Yamcs 5.8.6. An attacker can obtain the session cookie by uploading a crafted HTML file, exposing confidentiality (session data) with no availability impact. CVSS 3.1 base score 6.1 (Network, Low attack complexity, No privileges required, User interaction required, Confiden...

The vulnerability of the cgi-bin/login.cgi file within the Sangfor NGAF firewall allows a hacker to execute arbitrary code.

The vulnerability of the cgi-bin/login.cgi file, exposed by the Sangfor NGAF firewall mechanism, is related to errors in processing the meta-symbolic cookie file in the PHPSESSID parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially...

CVE-2023-30806

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to...

CVE-2023-40537

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-40537

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Code injection

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-40537 Multi-blade VIPRION Configuration utility session cookie vulnerability

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-40537

CVE-2023-40537 affects BIG-IP on multi-blade VIPRION: an authenticated user’s session cookie may remain valid briefly after logout, enabling potential reuse to access management interfaces and execute commands. The vulnerability is limited to VIPRION multi-blade configurations and does not affect...

CVE-2023-40537 Multi-blade VIPRION Configuration utility session cookie vulnerability

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K29141800: Multi-blade VIPRION Configuration utility session cookie vulnerability CVE-2023-40537

Security Advisory Description An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. CVE-2023-40537 Impact A remote unauthenticated attacker may be able to reuse, for a limited time, an...

CVE-2023-40537: Insufficient Session Expiration

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

PT-2023-6399 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: The issue is related to an incorrect session expiration time, allowing an authenticated user's session cookie to remain valid for a limited time after logging out from the BIG-IP Configurati...

Insecure Session Cookie Handling

quarkus-oidc is vulnerable to Insecure OIDC Session Cookie Handling. The vulnerability exists because the library does not properly encrypt the OIDC session cookie value by default which leads to the leakage of both ID and access tokens in the authorization code flow when an insecure HTTP protoco...

CVE-2023-43325: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the dataredirecturl parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL...

CVE-2023-43325

Summary: MooSocial 3.1.8 is affected by a reflected XSS in the data[redirect_url] parameter on the login page. The vulnerability can allow an attacker to steal a user's session cookies and impersonate the account through a crafted URL. Affected component: mooSocial v3.1.8 (login/redirect_url hand...

CVE-2023-42328

An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie...

Hardcoded credentials

An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie...

CVE-2023-42328

An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie...

CVE-2023-42328

An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie...

CVE-2023-42328

An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie...