PT-2020-12873 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.6 Description: The issue arises from the fact that any Cross-Site Request Forgery CSRF token in any user's session can be used in another user's session. Normally, CSRF tokens should be unique to each user's session and...

Security Bulletin: IBM Security Information Queue does not invalidate sessions after logout (CVE-2020-4291)

Summary IBM Security Information Queue ISIQ session identifiers are not properly invalidated upon user logout from ISIQ's web UI. This create opportunities for an attacker to hijack a user session token. As of v1.0.6, ISIQ immediately invalidates the session token when a user logs out...

PT-2020-18345 · Parse · Parse Server

Name of the Vulnerable Software and Affected Versions: parser-server versions prior to 4.1.0 Description: The issue allows fetching all user objects by utilizing regex in the NoSQL query, specifically targeting the sessionToken. This can be achieved through the API endpoint "/parse/users/me" by...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

Cross site scripting

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393

CVE-2020-5393 affects Appspace On-Prem (up to 7.1.3). A Cross-Site Scripting (XSS) flaw can enable an attacker to steal session tokens. The CNVD entry for Appspace On-Prem Cross-Site Scripting Vulnerability corroborates the XSS vector, but the provided documents do not specify affected subcompone...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2013-4868

Karotz API 12.07.19.00: Session Token Information Disclosure...

Information disclosure

Karotz API 12.07.19.00: Session Token Information Disclosure...

CVE-2013-4868

CVE-2013-4868 affects Karotz API 12.07.19.00 and is described as a Session Token Information Disclosure. The connected documents confirm the product/version and the impact is information disclosure of session tokens; no root-cause or code-level details are provided in the supplied sources. No exp...

CVE-2013-4868

Karotz API 12.07.19.00: Session Token Information Disclosure...

CVE-2019-18573

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote...

CVE-2019-15235

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/USERNAME/tmp/session/sessxxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/accesslog, then use them to gain access to the victim's password for the OS and...

Input validation

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability ...

Session Token In URL

PhpBB sends the session token via a GET parameter in the URL. Due to the way phpbb works, having the session ID is not enough for a remote attacker to gain access to the application since the session tokens are tied to an IP address. However, with knowledge of the administrator's session ID, the...

CVE-2019-1937

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing...

CVE-2019-1937

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing...

CVE-2019-1937

CVE-2019-1937 affects Cisco UCS Director/UCS Director Express for Big Data and IMC Supervisor via an authentication bypass in the web-based management interface caused by insufficient request header validation. An unauthenticated remote attacker could obtain a valid administrator session token an...