Cross site scripting

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...

CVE-2020-2103

Jenkins

PT-2020-15310 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.218 and earlier Jenkins LTS versions 2.204.1 and earlier Description: The issue allows attackers to obtain the HTTP session ID value from the /whoAmI page, potentially exploiting a cross-site scripting vulnerability. This...

Ruby Information Disclosure Vulnerability

Ruby is a cross-platform, object-oriented, dynamically typed programming language from the software developer Gyohiro Matsumoto. A security vulnerability exists in Ruby. An attacker can exploit this vulnerability by hijacking a session through a timing attack on the session ID...

PT-2019-14831

Name of the Vulnerable Software and Affected Versions Rack versions prior to 1.6.12 Rack versions prior to 2.0.8 Description There's a possible information leak / session hijack issue in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id...

CVE-2019-4411

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658...

Design/Logic Flaw

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658...

CVE-2019-4411

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658...

eQ-3 Homematic CCU3 Session Fixation Vulnerability

The eQ-3 Homematic CCU3 is a central control unit for smart home systems from eQ-3 Germany. A session fixation vulnerability exists in the eQ-3 Homematic CCU3 using firmware version 3.41.11, which can be exploited by an attacker to log in and control the system by creating a session ID and sendin...

CVE-2019-6656

BIG-IP APM Edge Client before version 7.1.8 7180.2019.508.705 logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1, 14,1.0-14.1.0.6, 14.0.0-14.0.0.4, 13.0.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5. In BIG-IP APM...

DEBIAN-CVE-2019-12746

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

The vulnerability of the Jenkins automation server, related to the absence of a web session identifier, allows attackers to perform cross-site forgery attacks and gain unauthorized access to protected information.

The vulnerability of the Jenkins automation server relates to the absence of a web session identifier. Exploiting this vulnerability allows a malicious actor to perform cross-site fraudulently and gain unauthorized access to protected information...

The vulnerability of SIEMENS LOGO!8’s microprogramming software, related to improper access control, allows a perpetrator to gain access to the device.

The vulnerability of the microprogramming software of SIEMENS LOGO!8 programmable logic controllers is related to improper access control. Exploiting this vulnerability could allow an attacker, operating remotely, to use the intercepted session identifier to gain access to the device even after t...

CVE-2019-10121

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin...

Siemens LOGO!8 License Issue Vulnerability

LOGO!8 is the 8th generation of Siemens intelligent logic controllers, the Nano PLC in the Siemens PLC family, which simplifies programming configurations, has an integrated panel for more displays, and can be easily networked and efficiently interconnected via the integrated Ethernet interface. ...

Code injection

The HTTP API supported by Starry Station aka Starry Router allows brute forcing the PIN setup by the user on the device, and this allows an attacker to change the Wi-Fi settings and PIN, as well as port forward and expose any internal device's port to the Internet. It was identified that the devi...

Cisco Wireless LAN Controller Software Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

Semrush: Web cache deception attack - expose earning state information

Hello, I have found new Vulnerability in your website which called Web cache deception attack. It's found first time in Paypal. Web Cache Deception Attack Websites often tend to use web cache functionality to store files that are often retrieved, to reduce latency from the web server. Let's see a...

Brocade Fabric OS Session ID Interception and Manipulation Vulnerability

Fabric OS is the firmware for Brocade Communications Systems' Fibre Channel switches and Fibre Channel controllers. A session ID interception and manipulation vulnerability exists in the Web management interface of Brocade Fabric OS prior to 8.2.1, 8.1.2f, 8.0.2f, and 7.4.2d. An attacker could us...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...