CVE-2020-8986: Improper Check for Unusual or Exceptional Conditions

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...

PT-2020-20409

Name of the Vulnerable Software and Affected Versions ZendTo versions prior to 5.22-2 Beta Description The issue is related to the lib/NSSDropbox.php file in ZendTo, where it failed to properly check for equality when validating the session cookie. This allows an attacker to gain administrative...

Security Bulletin: WebSphere DataPower XC10 Appliance vulnerabilities exist in the administrative console and session cookie at login (CVE-2014-3059 and CVE 2014-2060)

Summary In certain configurations, a security vulnerability exists in WebSphere DataPower XC10 Appliance. A WebSphere eXtreme Scale attacker could gain administrative access to the device. Vulnerability Details VULNERABILITY DETAILS: CVEID: CVE-2014-3059 In certain configurations, a security...

Denial of service

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...

CVE-2019-19611

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...

PT-2020-10198

Name of the Vulnerable Software and Affected Versions Halvotec RaQuest versions prior to 10.24.11206.1 Description An issue was discovered that allows an anonymous user to access the list of connected users as well as the session cookie for each user through one of the exposed web services...

CVE-2019-19611: Undefined Security Weakness

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1...

Pandora FMS Ping Authenticated Remote Code Execution

This module exploits a vulnerability found in Pandora FMS 7.0NG and lower. nettools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands. Module Options msf use exploit/linux/http/pandora/pingcmdexec msf undefinedpingcmdexec show actions ...actions... msf...

CVE-2020-9449

An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS client, and BlaB! WS Pro client version 19.11 allows an attacker with a guest or user session cookie to escalate privileges by retrieving the cookie salt value and creating a valid session cookie for an arbitra...

CVE-2020-9449

CVE-2020-9449 affects BlaB! AX/AX Pro and BlaB! WS clients (version 19.11) due to insecure RNG. An attacker with a guest or user session cookie can retrieve the cookie salt value and craft a valid session cookie to escalate privileges to other users or admin. Root cause: weak/random generation in...

PT-2020-20667

Name of the Vulnerable Software and Affected Versions BlaB! AX version 19.11 BlaB! AX Pro version 19.11 BlaB! WS client version 19.11 BlaB! WS Pro client version 19.11 Description An insecure random number generation issue allows an attacker with a guest or user session cookie to escalate...

TopManage OLK Elevation of Privilege Vulnerability

TopManage OLK is a suite of e-commerce management solutions from TopManage Panama. A security vulnerability exists in TopManage OLK version 2020, which stems from the program's failure to set ReadOnly for session cookies, and can be exploited by an attacker to compromise user and administrator...

CVE-2020-6845

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

CVE-2020-6845

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

Design/Logic Flaw

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

CVE-2020-6845

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

CVE-2020-6845

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

PT-2020-19260

Name of the Vulnerable Software and Affected Versions TopManage OLK version 2020 Description The issue allows for a DOM-Based XSS attack, enabling the takeover of user and admin accounts due to the lack of ReadOnly protection on the Session cookie. Recommendations For TopManage OLK version 2020,...

CVE-2020-6845: Improper Neutralization of Input During Web Page Generation

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...