PrinterOn Central Print Services Security Bypass Vulnerability

PrinterOn Central Print Services CPS is a print service center management solution from PrinterOn Canada. A security vulnerability exists in PrinterOn CPS version 4.1.4 and earlier, which stems from a failure to perform full session cookie inspection in the core component used to create and launc...

CVE-2018-17210

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass...

CVE-2018-17210

CVE-2018-17210 affects PrinterOn Central Print Services (CPS) up to version 4.1.4. The core components that create and launch print jobs do not perform complete verification of the session cookie, enabling an attacker with guest/pseudo-guest permissions to bypass session checks by calling the cor...

CVE-2019-12927

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...

Cross site scripting

An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily...

CVE-2018-10692

An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily...

CVE-2018-10692

The CVE-2018-10692 issue affects Moxa AWK-3121 devices (version 1.14) where the session cookie Password508 is not HttpOnly, enabling a cross-site scripting attacker to steal the cookie. Connected sources (NVD, CISA/ICS advisory, and Nessus plugin) confirm this vulnerability is tied to the HTTP co...

CVE-2018-10692

An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily...

CVE-2019-7215

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions...

CVE-2018-5405

CVE-2018-5405 affects Quest Kace K1000 Appliance (SMA) versions prior to 9.0.270. A authenticated, least-privileged user with ‘User Console Only’ rights can inject arbitrary JavaScript on the tickets page due to insufficient input neutralization, enabling potential session cookie theft and takeov...

Pydio Core <= 8.2.2 Multiple Vulnerabilities

Pydio Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pydio:pydio"; ifdescription...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

Design/Logic Flaw

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...

CVE-2019-10045

CVE-2019-10045 affects Pydio (web application) up to version 8.2.2, where the action get_sess_id leaks the session cookie value in the HTTP response body. This enables a script to access the session identifier and potentially impersonate a user if a session is active. The issue is a result of lea...

EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1605)

According to the version of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web...

EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2019-1622)

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to...

EulerOS 2.0 SP2 : cups (EulerOS-SA-2019-1566)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - CUPS printing system provides a portable printing layer for UNIXAr operating systems. It has been developed by Apple Inc.to promote a standard...

EulerOS 2.0 SP5 : cups (EulerOS-SA-2019-1568)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - CUPS printing system provides a portable printing layer for UNIXAr operating systems. It has been developed by Apple Inc.to promote a standard...