CVE-2023-0867

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horiz...

Design/Logic Flaw

IBM Spectrum Protect Plus Container Backup and Restore 10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session...

PT-2021-12273

Name of the Vulnerable Software and Affected Versions IBM Security Identity Governance and Intelligence version 5.2.6 Description The issue allows a user to obtain sensitive information from another user's session because the session is not invalidated after logout. Recommendations For IBM Securi...

Session Information Disclosure Vulnerability

Session is a new type of encrypted private messenger open-sourced by Oxen. An information disclosure vulnerability exists in Netsia SEBA+ version 0.16.1 build 70-e669dcd7, which can be exploited by an attacker to discover a session cookie via a direct session list allActiveSession request...

PT-2020-13843

Name of the Vulnerable Software and Affected Versions Navigate CMS version 2.9 r1433 Description An issue was discovered where sessions and associated information, such as CSRF tokens, are stored in cleartext files in the /private/sessions directory. This could allow an unauthenticated user to us...

Debian DSA-4069-1 : otrs2 - security update

Francesco Sirocco discovered a flaw in otrs2, the Open Ticket Request System, which could result in session information disclosure when cookie support is disabled. A remote attacker can take advantage of this flaw to take over an agent's session if the agent is tricked into clicking a link in a...

[SECURITY] [DLA 1215-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1deb7u3 CVE ID : CVE-2017-17476 Debian Bug : 884801 Francesco Sirocco discovered a flaw in otrs2, the Open Ticket Request System, which could result in session information disclosure when cookie support is disabled. A remote attacker can take advantage of this fla...

Debian: Security Advisory (DSA-4069-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-4869

CVE-2016-4869 (Cybozu Office) : Cybozu Office versions 9.0.0–10.4.0 contain an information disclosure vulnerability where a page displaying CGI environment variables can leak session information. An unauthenticated remote attacker may obtain a user’s session data via that page. The issue’s impact...

PT-2017-8566

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 9.0.0 through 10.4.0 Description The issue allows remote attackers to obtain session information via a page where CGI environment variables are displayed. Recommendations For Cybozu Office versions 9.0.0 through 10.4.0,...

PT-2017-17019

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Terminal Services Agent versions 6.0 through 8.0 Description The issue allows attackers to obtain sensitive session information due to weak permissions for unspecified resources. Recommendations For versions 6.0 through 8.0,...

CVE-2012-0328: Exposure of Sensitive Information to an Unauthorized Actor

Janetter before 3.3.0.0 aka 3.3.0 allows remote attackers to obtain session information for twitter.com web sites via unspecified vectors...

phprpg-sql.txt

By Michael Brooks Vulneralbity: Sql Injection and Session Information Disclosure. Homepage:http://sourceforge.net/projects/phprpg/ Verison affected 0.8.0 There are two flaws that affect this applcation. A nearly vinnella login bypass issues affects phprpg. If magicqutoesgpc=off then this will log...