5187 matches found
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
Session fixation
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p is affected by CVE-2022-31798: an XSS vulnerability combined with local session fixation via the PHPSESSID when devices are chained, enabling account takeover of admin or lower-privileged users. The issue arises at the /card_scan.php?CardFormatNo= endpoint....
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
Session fixation
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997 Session Fixation in snipe/snipe-it
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997
CVE-2022-2997 affects the Snipe-IT project (snipe/snipe-it) prior to 6.0.10. Root cause: a session-fixation issue where the session is not invalidated after a password change. Impact: could enable unauthorized access to user accounts if exploited. Remediation: upgrade to version 6.0.10 or later; ...
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997 Session Fixation in snipe/snipe-it
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-31798: Session Fixation
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-2997: Session Fixation
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
PT-2022-19934 · Snipe · Snipe-It
Name of the Vulnerable Software and Affected Versions: snipe/snipe-it versions prior to 6.0.10 Description: The issue concerns a session fixation problem where the session is not invalidated after a password change. This could potentially allow unauthorized access to user accounts. Recommendation...
PT-2022-20940 · Nortek Linear · Nortek Linear Emerge E3-Series
Name of the Vulnerable Software and Affected Versions: Nortek Linear eMerge E3-Series version 0.32-07p Description: The issue allows an attacker to take over an admin account or a user account through a combination of XSS and session fixation via the PHPSESSID when devices are chained together...
Session Fixation
Description The session is not invalidated after a password change. Proof of Concept Open Snipe-IT in the browser and login. Do the same in a private window such that there are two sessions. Change the password in one of the two sessions and observe that the second session is not invalidated...
WWBN AVideo session id privilege escalation vulnerability
Talos Vulnerability Report TALOS-2022-1535 WWBN AVideo session id privilege escalation vulnerability August 16, 2022 CVE Number CVE-2022-30605 SUMMARY A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafte...