PT-2020-18793

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 7.1.5 through 7.1.8 Description The issue allows attackers to obtain the full session ID from process memory in the BIG-IP Edge Client components of BIG-IP APM, Edge Gateway, and FirePass legacy. Recommendations For versions...

CVE-2020-10714

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

CVE-2020-11728

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time and the incrementing sessionid can impersonate a session...

CVE-2020-1773

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...

Nagios Log Server Incorrect Access Control Vulnerability

Nagios Log Server is a powerful enterprise-grade log monitoring and management application that allows organizations to quickly and easily view, sort, and configure logs from any source on any given network. An incorrect access control vulnerability exists in Nagios Log Server 2.1.3. An attacker...

CVE-2020-6178

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...

CVE-2020-6178

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...

Information disclosure

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...

CVE-2020-6178

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...

PT-2020-18984

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions prior to 1911 Description The issue allows the Session ID cookie value to be sent in the URL, which could be stolen from browser history or log files, leading to information disclosure. Recommendations For versions prio...

CVE-2020-6178: Exposure of Sensitive Information to an Unauthorized Actor

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure...

SQL Injection Vulnerability in Manage.php of Jinwei Smart Restaurant System Version 0.7.2

Jinwei Smart Restaurant System is a free restaurant management software. It is suitable for all kinds of large and small restaurants, as well as fast food, Chinese food, western food, hot pot restaurant and other kinds of catering business. SQL injection vulnerability exists in manage.php in...

InnoGames: Create any military unit in any age

Summary of the Issue It's possible to create a sniperbot unit in the bronze age by sending a crafted request to xs1.forgeofempires.com/game/json endpoint Steps to reproduce 1 Login to https://xs1.forgeofempires.com with Chrome browser while observing network tab. 2 Open the poc20200227.html F7304...

PT-2020-03: Information disclosure in Сisco ASA and Cisco FTD

Successful exploitation of this vulnerability allows an unauthorized, remote attacker to read arbitrary heap memory of the device and obtain a valid session ID of a user connected to Cisco VPN. The attacker can use the obtained session ID to access the organization’s intranet. Cisco ASA memory ma...

CVE-2014-10400

CVE-2014-10400 affects CGILua’s session.lua in 5.0.x, where sequential session IDs enable remote attackers to predict and hijack arbitrary sessions. The vulnerability stems from the use of predictable session IDs, as noted in the CVE description, and CVE-2014-10400 was SPLIT from CVE-2014-2875. P...

PT-2020-6798 · Artica · Artica Pandora Fms

Name of the Vulnerable Software and Affected Versions: Artica Pandora FMS version 742 Description: A SQL injection issue in the pandora console component allows an unauthenticated attacker to bypass login restrictions by exploiting the session id parameter in the "/include/chart generator.php" AP...

Ubiquiti Inc.: Web Server Predictable Session ID on EdgeSwitch

In EdgeSwitch legacy web interface the SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection. These vulnerabilities were found on EdgeSwitch 1G switch ESWH and EdgeSwitch 10G switch ESGH firmware v1.9.0. The fix for the...

F5 Networks BIG-IP : BIG-IP APM logging disclosure vulnerability (K37890841)

The BIG-IP APM system logs the client-session-id when a per-session policy is attached to the virtual server with debug logging enabled.CVE-2019-19150 Impact The BIG-IP APM system logs the client-session-id in the log files and is available to authenticated administrators of the system. C Tenable...

FreeBSD : rack -- information leak / session hijack vulnerability (66e4dc99-28b3-11ea-8dde-08002728f74c)

National Vulnerability Database : There's a possible information leak / session hijack vulnerability in Rack RubyGem rack. This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids ar...

CVE-2019-19150

On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP APM system logs the client-session-id when a per-session policy is attached to the virtual server with debug logging enabled...