Synology Photo Station Session Fixation Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A session fixation vulnerability exists in SYNO.PhotoStation.Auth in Synology Photo Station versions prior to 6.8.7-3481, which can be exploited by remote attackers to hijack a web session with...

CVE-2018-18380: Session Fixation

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...

CVE-2018-12520

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard...

CVE-2018-12520: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard...

CVE-2018-1243

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

Spoofing

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

CVE-2018-1243

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

CVE-2018-1243

CVE-2018-1243 affects Dell EMC iDRAC6 (prior to 2.91), iDRAC7/8 (prior to 2.60.60.60), and iDRAC9 (prior to 3.21.21.21). The root cause is a weak CGI session ID using 96-bit numeric-only values, enabling remote attackers to perform bruteforce session guessing on active CGI sessions. Impact descri...

CVE-2018-1243 iDRAC6/iDRAC7/iDRAC8 - Weak CGI session ID vulnerability

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

CVE-2018-1243: Improperly Implemented Security Check for Standard

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

PT-2018-11165

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC6 versions prior to 2.91 Dell EMC iDRAC7/iDRAC8 versions prior to 2.60.60.60 Dell EMC iDRAC9 versions prior to 3.21.21.21 Description The issue concerns a weak CGI session ID. Sessions invoked via CGI binaries use 96-bit...

Cisco Meeting Server Session Fixation Vulnerability

Cisco Meeting Server formerly known as Acano Conferencing Server, CMS is the United States Cisco Cisco company's set of audio and video conferencing server software. A session fixation vulnerability exists in the session identifier management feature of the web-based management interface in Cisco...

Transmission: Remote code execution

Background Transmission is a cross-platform BitTorrent client. Description A vulnerability was discovered in how Transmission handles access control through the X-Transmission-Session-Id. Impact A remote attacker could execute arbitrary RFC commands or consequently conduct a DNS rebinding attack...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo One - Algo Risk Application (CVE-2016-8745)

Summary IBM Algo One - Algo Risk Application could allow a remote attacker to obtain sensitive information, caused by the improper handling of the send file code for the NIO HTTP connector when the Connector code for Tomcat is refactored. An attacker could exploit this vulnerability to obtain the...

Security Bulletin: Apache Tomcat vulnerability affects IBM Algo One - Counterparty Credit Risk (CVE-2016-8745)

Summary Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by the improper handling of the send file code for the NIO HTTP connector when the Connector code for Tomcat is refactored. An attacker could exploit this vulnerability to obtain the session ID and the...

Session fixation

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web...

IBM API Connect Information Disclosure Vulnerability (CNVD-2018-10950)

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. A security vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.8.2, which stems from...

IBM Security Guardium Big Data Intelligence Session ID Not Updated Vulnerability

IBM Security Guardium Big Data Intelligence is a solution that delivers the capabilities of a big data platform while meeting data security requirements. IBM Security Guardium Big Data Intelligence SonarG suffers from a session identifier not updated vulnerability. The vulnerability arises becaus...

Fedora 27 : perl-Dancer2 (2018-59eb033684)

Dancer2 0.206000 addresses several potential security issues. There is a potential RCE with regards to Storable. Dancer2 adds session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE. Parsing...

Authentication flaw

The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authentication...