CVE-2024-36426

In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session...

CVE-2024-36426

In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session...

CVE-2024-23554

Cross-Site Request Forgery CSRF on Session Token vulnerability that could potentially lead to Remote Code Execution RCE...

CVE-2024-23554

The CVE-2024-23554 entry affects the HCL BigFix Platform and describes a CSRF on a Session Token that could lead to Remote Code Execution (RCE). Affected versions are: prior to 9.5.24, prior to 10.0.11, and prior to 11.0.1. Remediation is to upgrade to 9.5.24 or later, 10.0.11 or later, or 11.0.1...

CVE-2024-23554 HCL BigFix Platform is susceptible to Cross-Site Request Forgery

Cross-Site Request Forgery CSRF on Session Token vulnerability that could potentially lead to Remote Code Execution RCE...

CVE-2024-23554 HCL BigFix Platform is susceptible to Cross-Site Request Forgery

Cross-Site Request Forgery CSRF on Session Token vulnerability that could potentially lead to Remote Code Execution RCE...

PT-2024-19936

Name of the Vulnerable Software and Affected Versions HCL BigFix Platform versions prior to 9.5.24 HCL BigFix Platform versions prior to 10.0.11 HCL BigFix Platform versions prior to 11.0.1 Description The issue is related to a Cross-Site Request Forgery CSRF on Session Token vulnerability that...

CVE-2024-28134

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as...

CVE-2024-28134 PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as...

Directus 代码问题漏洞

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A code issue vulnerability exists in Directus versions prior to 10.11.0, which stems from a session token feature that does not expire upon logout...

PHOENIX CONTACT CHARX SEC-3000 安全漏洞

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in the PHOENIX CONTACT CHARX SEC-3000 version 1.5.1 and earlier, which originates from an unauthenticated, remote attacker who can extract session tokens via a MitM attack...

PT-2024-22284 · Phoenix Contact · Phoenix Contact Charx Sec-3100

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 versions up to 1.5.1 Description: An unauthenticated remote attacker can extract a session token with a Man-in-the-Middle MitM attack and gain web-based management access with the privileges of the currently...

Directus Lacks Session Tokens Invalidation

Summary Currently session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The directussession gets destroyed and the cookie gets deleted but if you captured the cookie value it will still work for the entire expiry time which is set to 1 day by...

CVE-2024-34709 Directus Lacks Session Tokens Invalidation

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The directussession gets destroyed and the cookie gets deleted but if the cookie value is...

PT-2024-26123 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.11.0 Description: The issue concerns session tokens that do not get properly invalidated when a user logs out. Specifically, the directus session is destroyed, and the cookie is deleted, but if the cookie value i...

Panel.SmokeLoader MVID-2024-0682 Cross Site Request Forgery / Cross Site Scripting

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/4b5fc3a2489985f314b81d35eac3560fB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Panel.SmokeLoader Vulnerability: Cross Site Request Forgery CSRF - Persistent XSS Family:...

PT-2024-22615 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions 19.4.0 through 23.5.0 Description: The issue is a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a redirect to query parameter with inadequate validation. Attacker...

Insufficient Verification Of Data Authenticity

org.wildfly.security:wildfly-elytron-http-oidc is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to the session token caching logic when an OIDC app serving multiple tenants accesses a new tenant with a different OIDC configuration. This flaw occurs in...

CVE-2024-29023

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...

CVE-2024-29023

CVE-2024-29023 affects Xibo CMS: session tokens are exposed in the session-search API response, enabling potential session hijacking when users have access to the sessions page. Affected software is Xibo: upgrades are recommended to close the issue. Remediation per sources: Upgrade to Xibo 3.3.10...