CVE-2024-4601

CVE-2024-4601 affects Socomec Net Vision (version 7.20) and is described as an improper authentication vulnerability. The root cause is the use of five‑digit integer values, which enables a brute‑force attack to recover a valid session. Multiple connected records (CNVD/CNNVD/NVD variants) corrobo...

CVE-2023-40695

Summary: CVE-2023-40695 affects IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0, where the product does not invalidate the user session after logout, enabling an authenticated user to impersonate another user. The issue is tied to session handling in IBM Cognos Controller and is documented with ...

SOPlanning 1.52.00 Cross Site Scripting Vulnerability

Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS Reflected XSS Application: SOPlanning Version: 1.52.00 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE: Not yet assign...

SOPlanning 1.52.00 Cross Site Scripting

Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS Reflected XSS Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE:...

CVE-2024-3411

Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device...

CVE-2024-3411 Insufficient Randomness When Validating an IPMI Authenticated Session

Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device...

CVE-2024-3411 Insufficient Randomness When Validating an IPMI Authenticated Session

Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device...

CVE-2023-38002

IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force ID: 260208...

CVE-2024-4336

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user...

PT-2024-12677 · Ibm · Ibm Storage Scale

Name of the Vulnerable Software and Affected Versions: IBM Storage Scale versions 5.1.0.0 through 5.1.9.2 Description: The issue allows an authenticated user to steal or manipulate an active session to gain access to the system. Recommendations: For versions 5.1.0.0 through 5.1.9.2, update to a...

PT-2024-25703 · Ipmi · Ipmi

Name of the Vulnerable Software and Affected Versions: IPMI affected versions not specified Description: The issue concerns implementations of IPMI Authenticated sessions that do not provide enough randomness, making them susceptible to session hijacking. An attacker can exploit this by using...

BMC software fails to validate IPMI session.

Overview The Intelligent Platform Management Interface IPMI implementations in multiple manufacturer's Baseboard Management Controller BMC software are vulnerable to IPMI session hijacking. An attacker with access to the BMC network with IPMI enabled can abuse the lack of session integrity to...

IPMI 安全漏洞

IPMI is an IPMI open source specification for a computer interface. It provides the ability to monitor and control the operational status of the system's central processor, firmware, and operating system. A security vulnerability exists in IPMI that stems from an inability to provide enough...

CVE-2024-1579

Incorrect Usage of Seeds in Pseudo-Random Number Generator PRNG vulnerability in Secomea GateManager Webserver modules allows Session Hijacking.This issue affects GateManager: before 11.2.624071020...

CVE-2024-1579 Insufficient seeding of random number generator

Incorrect Usage of Seeds in Pseudo-Random Number Generator PRNG vulnerability in Secomea GateManager Webserver modules allows Session Hijacking.This issue affects GateManager: before 11.2.624071020...

CVE-2024-1579 Insufficient seeding of random number generator

Incorrect Usage of Seeds in Pseudo-Random Number Generator PRNG vulnerability in Secomea GateManager Webserver modules allows Session Hijacking.This issue affects GateManager: before 11.2.624071020...

CVE-2024-1579

The CVE concerns Secomea GateManager, specifically the Webserver modules, with an underlying flaw in the PRNG seeding. The root cause is Incorrect Usage of Seeds in the PRNG, which can lead to session hijacking. Affected/version info: GateManager before 11.2.624071020. Documented impact indicates...

Doctor Appointment Management System 1.0 Cross Site Scripting

Application Name: Doctor Appointment Management System Software Link: Download Link Vendor Homepage: Vendor Homepage BuG: XsS BUGAuthor: SoSPiro Version: 1.0 CVE: CVE-2024-4293 Vulnerable code section: - http://localhost/Doctor-Appointment-SystemPHP/dams/doctor/appointment-bwdates.php - Lines 57-...

PT-2024-18147 · Secomea · Secomea Gatemanager

Name of the Vulnerable Software and Affected Versions: Secomea GateManager versions prior to 11.2.624071020 Description: The issue is related to the incorrect usage of seeds in the Pseudo-Random Number Generator PRNG in the Secomea GateManager's Webserver modules, allowing session hijacking...

CVE-2023-6787

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...