PT-2020-18345 · Parse · Parse Server

Name of the Vulnerable Software and Affected Versions: parser-server versions prior to 4.1.0 Description: The issue allows fetching all user objects by utilizing regex in the NoSQL query, specifically targeting the sessionToken. This can be achieved through the API endpoint "/parse/users/me" by...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

Cross site scripting

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393

CVE-2020-5393 affects Appspace On-Prem (up to 7.1.3). A Cross-Site Scripting (XSS) flaw can enable an attacker to steal session tokens. The CNVD entry for Appspace On-Prem Cross-Site Scripting Vulnerability corroborates the XSS vector, but the provided documents do not specify affected subcompone...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2013-4868

Karotz API 12.07.19.00: Session Token Information Disclosure...

Information disclosure

Karotz API 12.07.19.00: Session Token Information Disclosure...

CVE-2013-4868

CVE-2013-4868 affects Karotz API 12.07.19.00 and is described as a Session Token Information Disclosure. The connected documents confirm the product/version and the impact is information disclosure of session tokens; no root-cause or code-level details are provided in the supplied sources. No exp...

CVE-2013-4868

Karotz API 12.07.19.00: Session Token Information Disclosure...

CVE-2019-18573

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote...

CVE-2019-15235

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/USERNAME/tmp/session/sessxxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/accesslog, then use them to gain access to the victim's password for the OS and...

Input validation

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability ...

Session Token In URL

PhpBB sends the session token via a GET parameter in the URL. Due to the way phpbb works, having the session ID is not enough for a remote attacker to gain access to the application since the session tokens are tied to an IP address. However, with knowledge of the administrator's session ID, the...

CVE-2019-1937

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing...

CVE-2019-1937

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing...

CVE-2019-1937

CVE-2019-1937 affects Cisco UCS Director/UCS Director Express for Big Data and IMC Supervisor via an authentication bypass in the web-based management interface caused by insufficient request header validation. An unauthenticated remote attacker could obtain a valid administrator session token an...

Imagecache External - Critical - Insecure session token management - SA-CONTRIB-2019-065

This module that allows you to store external images on your server and apply your own Image Styles. The module exposes cookies to external sites when making external image requests. This vulnerability is mitigated by using the whitelisted host feature to restrict external image requests from...