CVE-2023-35857

CVE-2023-35857 affects Siren Investigate prior to 13.2.2. The issue is that session keys remain active after logout, enabling potential unauthorized access to user sessions. The CVSS v3.1 score is 9.8 (CRITICAL) with network attack vector, no privileges required, and no user interaction. Affected...

CVE-2023-35857

In Siren Investigate before 13.2.2, session keys remain active even after logging out...

SUSE CVE-2015-5143

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service session store consumption via multiple requests with unique session keys...

Privilege Escalation

samba is vulnerable to Privilege Escalation. The vulnerability exists in the Window Kerberos RC4-HMAC component due to the weak rc4-hmac session keys for use between modern clients and servers...

rc4-hmac Kerberos session keys issued

Description Kerberos, the trusted third party authentication system at the heart of Active Directory, issues a session key known to the target server and the client, encrypted to both services in a TGS-REP. The key algorithm chosen for here is then used for the subsequent signed or encrypted...

USN-5690-1: libXdmcp vulnerability

It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain another user's key...

USN-5690-1 libxdmcp vulnerability

It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain another user's key...

Ubuntu 16.04 ESM : libXdmcp vulnerability (USN-5690-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5690-1 advisory. It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain anothe...

CVE-2022-22922

TP-Link TL-WA850RE Wi-Fi Range Extender before v6200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges...

CVE-2022-22922

TP-Link TL-WA850RE Wi-Fi Range Extender before v6200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges...

CVE-2022-22922

TP-Link TL-WA850RE Wi-Fi Range Extender before v6200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges...

Code injection

TP-Link TL-WA850RE Wi-Fi Range Extender before v6200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges...

CVE-2022-22922

TP-Link TL-WA850RE Wi-Fi Range Extender before v6200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges...

Tp-link TL-WA850RE licensing issue vulnerability

The Tp-link TL-WA850RE is a 300Mbps wireless LAN repeater from Tp-link, China. It enhances WiFi signals to reach locations that routers cannot reach, while reducing interference.A security vulnerability exists in versions prior to TP-Link TL-WA850RE v6 200923, which stems from the fact that Wi-Fi...

Tp-link TL-WA850RE 安全特征问题漏洞

The Tp-link TL-WA850RE is a 300Mbps wireless LAN repeater from Tp-link, China. It enhances WiFi signals to reach locations that routers cannot reach, while reducing interference.A security vulnerability exists in versions prior to TP-Link TL-WA850RE v6 200923, which stems from the fact that Wi-Fi...

PT-2022-1650 · Tp Link · Tp-Link Tl-Wa850Re

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WA850RE versions prior to v6 200923 Description: The issue is related to the use of highly predictable and easily detectable session keys in the TP-Link TL-WA850RE Wi-Fi Range Extender. This allows attackers to gain administrative...

GHSA-F2C5-997W-7F5C Cross-site Scripting in peertube

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'. It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored i...

Cross-site Scripting in peertube

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'. It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored i...

Cross-site Scripting (XSS) - Stored in chocobozzz/peertube

✍️ Description We can upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers. 🕵️‍♂️ Proof of Concept 1.Go to...

in beestat/app

✍️ Description The random number generator implemented by mtrand on session keys is not suitable for cryptographic purposes generation of tokens, passwords, or cryptographic keys either. mtrand function that produces predictable values is utilized as a source of randomness in a security-sensitive...