CVE-2021-21902

An authentication bypass vulnerability exists in the CMA runserver6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection can lead to authentication bypass via session hijacking. An attacker can send a sequence of requests to trigger this...

CVE-2021-21902

An authentication bypass vulnerability exists in the CMA runserver6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection can lead to authentication bypass via session hijacking. An attacker can send a sequence of requests to trigger this...

Authentication flaw

An authentication bypass vulnerability exists in the CMA runserver6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection can lead to authentication bypass via session hijacking. An attacker can send a sequence of requests to trigger this...

CVE-2021-21902

The TALOS advisory documents an authentication bypass in Garrett Metal Detectors iC Module CMA Version 5.0, specifically in the CMA run_server_6877 function. A race condition allows an attacker with no password to hijack an authenticated session by copying the attacker’s socket over the legitimat...

CVE-2021-21902

An authentication bypass vulnerability exists in the CMA runserver6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection can lead to authentication bypass via session hijacking. An attacker can send a sequence of requests to trigger this...

PT-2021-14828 · Garrett Metal Detectors · Garrett Metal Detectors Ic Module Cma

Name of the Vulnerable Software and Affected Versions: Garrett Metal Detectors iC Module CMA version 5.0 Description: An authentication bypass issue exists in the CMA run server 6877 functionality. A properly-timed network connection can lead to authentication bypass via session hijacking. An...

Garrett Metal Detectors 授权问题漏洞

Garrett Metal Detectors is a walk-in metal detector from Garrett U.S.A. Garrett Metal Detectors is vulnerable to an authentication bypass vulnerability that could be exploited by attackers to bypass authentication with the help of session hijacking...

Garrett Metal Detectors iC Module CMA run_server_6877 authentication bypass vulnerability

Summary An authentication bypass vulnerability exists in the CMA runserver6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection can lead to authentication bypass via session hijacking. An attacker can send a sequence of requests to trigger th...

Easy Cart Shopping Cart - (Search) Persistent Vulnerability

Document Title: =============== Easy Cart Shopping Cart - Search Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2298 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities

Document Title: =============== uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2288 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

Cross site request forgery (csrf)

An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version the Linux version appears to have 8 characters. An attacker can obtain the static part of the cooki...

PT-2021-24048 · Reprise · Reprise Rlm

Name of the Vulnerable Software and Affected Versions: Reprise RLM version 14.2 Description: An issue was discovered in Reprise RLM where session cookies are small, allowing an attacker to hijack existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version. The Linu...

CVE-2021-44151

CVE-2021-44151 describes a session-hijacking flaw in Reprise RLM 14.2 where short 4-hex-character cookies on Windows enable brute-force to hijack active sessions. An attacker can discover the cookie name by requesting a page (e.g., /goforms/menu) and saving the cookie name, then resend requests w...

Reprise Software Reprise License Manager Licensing Issue Vulnerability

Reprise Software Reprise License Manager is a software licensing toolkit from Reprise Software, Inc. that provides local and cloud-based license management, license enforcement and product activation solutions for publishers of commercial software applications.Reprise Software Reprise License...

Cross-site Scripting (XSS) - Reflected in yeswiki/yeswiki

Description Hey all, i found that the search function of YesWiki integrates the searched term into a value attribute inside an input tag, for example if i do a search on sneaky for example, it will put the term sneaky inside a value attribute: html now if i add a double quote to the searched term...

Session Fixation

express-openid-connect is vulnerable to session fixation. The attack exists because the library does not regenerate the session id and cookie when user logs in, allowing a malicious user to hijack the session using earlier generated cookies...

PT-2021-7720 · Zabbix +2 · Zabbix +2

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the lack of protection of the web page structure in Zabbix, allowing a remote attacker to impact data integrity. An authenticated user can create a hosts group from t...

Reprise License Manager 14.2 Session Hijacking

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44151 Vulnerability Title: Unauthenticated Session Hijacking Severity: Medium/High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Date: 2021-11-...

Reprise License Manager 14.2 Session Hijacking Vulnerability

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44151 Vulnerability Title: Unauthenticated Session Hijacking Severity: Medium/High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Introduction: ...

Cross-site Scripting (XSS) - Generic in uiwjs/react-md-editor

Description XSS vulnerability through the markdown editor Proof of Concept Steps to Reproduce Visit the demo page. Past the payload in the markdown editor. Impact - Steal a user's token - Session hijacking...