CVE-2020-12467

CVE-2020-12467 affects Subrion CMS 4.2.1. The vulnerability arises from a session fixation flaw where an alphanumeric value in a session cookie can be used to establish a session. Documented impact is limited to session fixation; no broader exploitation details are provided. No official remediati...

Scientific Linux Security Update : cups on 7.x i686/x86_64 (2020:1050)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:1050-1 advisory. - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. CVE-2018-4180,...

CVE-2020-11729

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful...

Glassdoor: Reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/

Summary: There is a reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/ through the utmsource parameter. By using URL encoding I was able to bypass the WAF. Affected URL or select Asset from In-Scope: https://www.glassdoor.com/ Affected Parameter: utmsource Vulnerability Type: XSS...

Information Disclosure

squirrelmail is vulnerable to information disclosure. It was discovered that SquirrelMail allowed cookies over insecure connections ie did not restrict cookies to HTTPS connections. An attacker who controlled the communication channel between a user and the SquirrelMail server, or who was able to...

CentOS 7 : cups (RHSA-2020:1050)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1050 advisory. - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. CVE-2018-4180, CVE-2018-41...

RHEL 7 : cups (RHSA-2020:1050)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1050 advisory. The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups...

cups: Session cookie generated by the CUPS web interface is easy to guess

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10...

Moderate: Red Hat Security Advisory: cups security and bug fix update

An update for cups is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

cups: Predictable session cookie breaks CSRF protection

REJECTED CVE A predictable session cookie vulnerability was identified in the CUPS printing server. Insufficient randomness in session cookie generation made it easy to guess, undermining CSRF protection. This flaw allowed unauthorized scripted access to the CUPS web interface when enabled, posin...

CVE-2020-9055

Versiant LYNX Customer Service Portal CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or...

CVE-2020-9055

Versiant LYNX CSP 3.5.2 is vulnerable to stored cross-site scripting due to insufficient input validation, enabling a local, authenticated attacker to inject JavaScript that is stored and executed for end users (possible redirects, session cookie hijacking, information disclosure). The issue is d...

ZendTo Elevation of Privilege Vulnerability

ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. An elevation of privilege vulnerability exists in versions prior to ZendTo 5.22-2 Beta. The vulnerability stems from lib/NSSDropbox.php in ZendTo failing to...

CVE-2020-8986

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...

Code injection

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...

CVE-2020-8986

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...

CVE-2020-8986

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...

CVE-2020-8986

CVE-2020-8986 affects ZendTo prior to 5.22-2 Beta. The issue is in lib/NSSDropbox.php where equality is not correctly checked when validating the session cookie, enabling an attacker to gain administrative access with a large number of requests. The Red Hat/NVD entries corroborate the impact and ...

Security Bulletin: WebSphere DataPower XC10 Appliance vulnerabilities exist in the administrative console and session cookie at login (CVE-2014-3059 and CVE 2014-2060)

Summary In certain configurations, a security vulnerability exists in WebSphere DataPower XC10 Appliance. A WebSphere eXtreme Scale attacker could gain administrative access to the device. Vulnerability Details VULNERABILITY DETAILS: CVEID: CVE-2014-3059 In certain configurations, a security...

Denial of service

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...