CVE-2022-42159

creationtimestamp| type| source ---|---|--- 2022-10-13 22:28:21+00:00| seen| https://t.me/cibsecurity/51356...

Inductive Automation Ignition 安全漏洞

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, USA. The platform supports SCADA data acquisition and monitoring systems, HMI human machine interface and more. A security vulnerability exists in Inductive Automation Ignition...

CVE-2022-31273

An issue in TopIDP3000 Topsec Operating System tos3.3.005.665b.15smpidp allows attackers to perform a brute-force attack via a crafted sessionid cookie...

CVE-2021-35530 User authentication bypass in TXpert Hub CoreTec 4

A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an...

Learn How Hackers Can Hijack Your Online Accounts Even Before You Create Them

Malicious actors can gain unauthorized access to users' online accounts via a new technique called "account pre-hijacking," latest research has found. The attack takes aim at the account creation process that's ubiquitous in websites and other online platforms, enabling an adversary to perform a...

Gibbon 授权问题漏洞

Gibbon is a school platform that solves real-world problems that educators encounter every day. A security vulnerability exists in Gibbon version v23 that stems from the application not generating a new session ID cookie after a user is authenticated.The application is vulnerable to session...

Mattermost Server allows users with a session ID to revoke another users' session

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session...

GHSA-4JJJ-CM7Q-V6HR Jenkins Diagnostic page exposed session cookies

Jenkins shows various technical details about the current user on the /whoAmI page. In a previous fix, the Cookie header value containing the HTTP session ID was redacted. However, user metadata shown on this page could also include the HTTP session ID in Jenkins 2.218 and earlier, LTS 2.204.1 an...

GHSA-9XRJ-439H-62HG Improper Authentication in Apache Tomcat

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to...

Cross-Site Request Forgery in Apache Tomcat

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...

GHSA-XG5V-696H-C3VR Cloud Foundry UAA SessionID present in Audit Event Logs

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versio...

Security Bulletin: IBM Sterling Order Management is affected by a vulnerability (CVE-2016-5953)

Summary IBM Sterling Order Management is vulnerable by exposing the session identifier on an error page Vulnerability Details CVEID: CVE-2016-5953 DESCRIPTION: IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not...

Jetty Uses Predictable Session Identifiers

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possib...

PT-2022-17165 · Thinvnc · Thinvnc

Name of the Vulnerable Software and Affected Versions: ThinVNC version 1.0b1 Description: The issue allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. This can lead to code...

CVE-2021-27771

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...

Cisco Small Business 缓冲区错误漏洞

Cisco Small Business is a switch from Cisco USA. A buffer error vulnerability exists in the Cisco Small Business RV Series routers, which results from the use of weak entropy in the session identifier generation function. An attacker could exploit this vulnerability by using brute force to...

CVE-2021-39066

IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040...

CVE-2021-39066

Summary: CVE-2021-39066 affects IBM Financial Transaction Manager for SWIFT Services (multiplatform) version 3.2.4. The vulnerability arises because the product does not invalidate an existing session after certain events, enabling an attacker to hijack an authenticated session. This is documente...

CVE-2021-46308

An SQL Injection vulnerability exists in Sourcecodester Online Railway Reservation Sysytem 1.0 via the sid parameter...

Sourcecodester Online Railway Reservation system SQL注入漏洞

SourceCodester Online Railway Reservation system is a web-based application that provides an online platform for rail or train station passengers or potential passengers to browse their schedules and reserve seats. sourceCodester Online Railway Reservation system is vulnerable to a SQL injection...