PT-2022-12629 · Lanner · Iac-Ast2500A

Name of the Vulnerable Software and Affected Versions: Lanner Inc IAC-AST2500A version 1.10.0 Description: Session fixation and insufficient session expiration vulnerabilities allow an attacker to perform session hijacking attacks against users. Recommendations: For Lanner Inc IAC-AST2500A versio...

Insecure Session Management

rdiffweb is vulnerable to insecure session management. The vulnerability exists because user sessions are not properly defined with session persistent timeout which allows an attacker to access the active sessions of other users and perform unauthorized actions...

Oracle E-Business Suite (Oct 2022 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory. - Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: Upload. Supported versions...

CVE-2022-21636

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Session Management. Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2022-21636

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Session Management. Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Code injection

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Session Management. Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2022-21636

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Session Management. Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2022-21636

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Session Management. Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2022-21636

CVE-2022-21636 affects Oracle E-Business Suite’s Oracle Applications Framework (Session Management). Across multiple sources, affected versions are 12.2.6–12.2.11. The vulnerability allows a low-privilege, network-accessible attacker (via HTTP) to access or potentially exfiltrate data within Orac...

Apache Shiro Authentication Bypass Vulnerability (CNVD-2022-68497)

Apache Shiro is a Java security framework with authentication, access authorization, data encryption, session management, etc. An authentication bypass vulnerability exists in Apache Shiro, which is caused when requests are forwarded or requests are included via the RequestDispatcher interface, a...

Tacitine Firewall EN6200 Access Control Error Vulnerability

Tacitine Firewall EN6200 is a series of firewalls from Tacitine. The Tacitine Firewall EN6200 suffers from an Access Control Error vulnerability that stems from improper session management in Tacitine's web-based management interface. An unauthenticated, remote attacker could exploit the...

CVE-2022-40630

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 inclusive, due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this...

CVE-2022-40630

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 inclusive, due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this...

Session fixation

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 inclusive, due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this...

CVE-2022-40630 Improper Session Management Vulnerability in Tacitine Firewall

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 inclusive, due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this...

CVE-2022-40630 Improper Session Management Vulnerability in Tacitine Firewall

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 inclusive, due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this...

CVE-2022-40630

CVE-2022-40630 affects Tacitine Firewall EN6200 family: EN6200-PRIME QUAD-35 and QUAD-100, versions 19.1.1–22.20.1. Root cause is improper session management in the web-based management interface, enabling an unauthenticated remote attacker to perform session fixation. Impact is session fixation ...

Tacitine EN6200 授权问题漏洞

Tacitine Firewall EN6200 is a series of firewalls from Tacitine. The Tacitine Firewall EN6200 suffers from an Access Control Error vulnerability that stems from improper session management in Tacitine's web-based management interface. An unauthenticated, remote attacker could exploit the...

CVE-2022-40622 WAVLINK Quantum D4G (WN531G3) Session Management by IP Address

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

Insecure Session Management

org.apache.iotdb:iotdb-server uses insecure session management. Lack of proper validation of session ID at checkLogin function allows an attacker to bypass the intended authentication behavior through a session id attack...