CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18926

CVE-2018-18926: Gitea prior to 1.5.4 is vulnerable to remote code execution due to improper validation of session IDs in the go-macaron/session handling. Affected product is Gitea (Go-based repository server); the root cause is session management logic in Macaron. Public references consistently d...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18925

Gogs 0.11.66 is vulnerable to remote code execution due to improper validation of session IDs, demonstrated by a ".." session-file forgery in the file.go session provider. The issue stems from session handling in the Macaron-based go-macaron/session code, allowing an attacker to map a crafted ses...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

Remote code execution

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

Design/Logic Flaw

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

MGASA-2018-0428 Updated perl-Dancer2 packages fix security vulnerabilities

Dancer2 0.206000 addresses several potential security issues. There is a potential RCE with regards to Storable. Dancer2 adds session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE. Parsing...

PT-2018-19287

Name of the Vulnerable Software and Affected Versions Dancer2 versions prior to 0.206000 Description A potential remote code execution RCE issue exists due to a problem with Storable. To address this, Dancer2 now includes session ID validation in its session engine, allowing session backends base...

Synology Photo Station Session Fixation Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A session fixation vulnerability exists in SYNO.PhotoStation.Auth in Synology Photo Station versions prior to 6.8.7-3481, which can be exploited by remote attackers to hijack a web session with...

CVE-2018-18380: Session Fixation

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...

CVE-2018-12520

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard...

CVE-2018-12520: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard...

Spoofing

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

CVE-2018-1243

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

CVE-2018-1243

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

CVE-2018-1243

CVE-2018-1243 affects Dell EMC iDRAC6 (prior to 2.91), iDRAC7/8 (prior to 2.60.60.60), and iDRAC9 (prior to 3.21.21.21). The root cause is a weak CGI session ID using 96-bit numeric-only values, enabling remote attackers to perform bruteforce session guessing on active CGI sessions. Impact descri...