CVE-2023-4228

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized acce...

Information disclosure

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized acce...

CVE-2023-4228

CVE-2023-4228 affects ioLogik 4000 Series (ioLogik E4200) firmware v1.6 and earlier. The underlying issue is that session cookies are not configured with HttpOnly (and related attributes) as described across multiple sources, potentially allowing unauthorized access to session data. Public disclo...

CVE-2023-4228 ioLogik 4000 Series: Session Cookies Attribute Not Set Properly

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized acce...

MOXA ioLogik 4000 Series security vulnerabilities

MOXA ioLogik 4000 Series is a series of general-purpose controllers from China-based MOXA. A security vulnerability exists in MOXA ioLogik 4000 Series v1.6 and earlier versions, which stems from the session cookie attribute not being set correctly, potentially allowing user session data to be...

CVE-2023-25837: Improper Neutralization of Input During Web Page Generation

There is a Cross‑Site Scripting XSS vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser...

PT-2023-17324 · Atlas Copco · Atlas Copco Power Focus 6000

Name of the Vulnerable Software and Affected Versions: Atlas Copco Power Focus 6000 affected versions not specified Description: The issue concerns the Atlas Copco Power Focus 6000 web server, which utilizes a limited number of session ID numbers. This could allow an attacker to guess or enter a...

Intel DCM software security vulnerabilities

Intel DCM software is an application from Intel Corporation USA. A security vulnerability exists in Intel DCM software prior to version 5.0.1 that originates from exposing data elements to the wrong session, which could allow an authenticated user to potentially enable privilege escalation via...

CVE-2023-22620

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface...

PT-2023-5215 · Rockwell Automation · Pavilion8

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Pavilion8 affected versions not specified Description: The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could...

Code injection

Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain...

CVE-2023-0944: Incorrect Permission Assignment for Critical Resource

Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain...

PT-2023-16630 · Bhima · Bhima

Name of the Vulnerable Software and Affected Versions: Bhima version 1.27.0 Description: The issue allows an authenticated attacker with regular user permissions to update arbitrary user session data, including username, email, and password. This is due to the application being vulnerable to...

CVE-2023-0944

Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain...

Grafana Session Access

The vulnerability of the Grafana data processing web tool is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the current user’s session...

Opennms Group: OpenNMS Cross-Site Scripting Vulnerability

Opennms Group OpenNMS is an open source, enterprise-class network monitoring and network management platform from the U.S.-based Opennms Group. A security vulnerability exists in OpenNMS Meridian, Horizon, which is caused by a cross-site scripting XSS vulnerability in the webapp jsp page, which c...

Opennms Group: OpenNMS Cross-Site Scripting Vulnerability

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from US-based Opennms Group. A security vulnerability exists in Opennms Group OpenNMS Meridian and Horizon, which originates from a cross-site scripting vulnerability in the outage/list.ht...

PT-2023-8929 · Opennms · Opennms Horizon +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: The issue is related to unauthenticated, stored cross-site scripting in the display of alarm reduction keys, which could allow an attacker to...

K13217575: Session data may be exposed when using a proxy to multiplex connections to the BIG-IP APM system

Security Advisory Description This issue occurs when all of the following conditions are met: The BIG-IP APM system is configured to perform NTLM SSO authentication to back-end servers. A proxy in front of the BIG-IP APM system multiplexes connections from different users. Impact Users may be...

K94597539: Apache httpd vulnerability CVE-2018-1283

Security Advisory Description In Apache httpd 2.4.0 to 2.4.29, when modsession is configured to forward its session data to CGI applications SessionEnv on, not the default, a remote user may influence their content by using a "Session" header. This comes from the "HTTPSESSION" variable name used ...