GHSA-6W4Q-23CF-J9JP parse-server's session object properties can be updated by foreign user if object ID is known

Impact A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the user field and then read any custom fields of that session object. Note that assigning a session t...

parse-server's session object properties can be updated by foreign user if object ID is known

Impact A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the user field and then read any custom fields of that session object. Note that assigning a session t...

The vulnerability of the Login component in the file post_applogin.php is related to the ability to decode the session token of the Syncovery backup tool, which allows a hacker to increase their privileges.

The vulnerability of the Login component in the postapplogin.php file is related to the possibility of decoding the session token of the Syncovery backup tool. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

CVE-2022-40425

creationtimestamp| type| source ---|---|--- 2022-09-19 20:38:07+00:00| seen| https://t.me/cibsecurity/50054...

CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

DEBIAN-CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

Authentication flaw

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

UBUNTU-CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

CVE-2021-42948

HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's...

CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

PT-2022-11750 · Unknown +1 · Hoteldruid Hotel Management +1

Name of the Vulnerable Software and Affected Versions: HotelDruid Hotel Management Software version 3.0.3 Description: The issue concerns the controlla login function in the software, which generates a predictable session token. This predictability allows attackers to bypass authentication throug...

Syncovery For Linux Web-GUI Authenticated Remote Command Execution

This module exploits an authenticated command injection vulnerability in the Web GUI of Syncovery File Sync & Backup Software for Linux. Successful exploitation results in remote code execution under the context of the root user. Syncovery allows an authenticated user to create jobs, which are...

Syncovery For Linux Web-GUI Session Token Brute-Forcer

This module attempts to brute-force a valid session token for the Syncovery File Sync & Backup Software Web-GUI by generating all possible tokens, for every second between 'DateTime.now' and the given X days. By default today and yesterday DAYS = 1 will be checked. If a valid session token is...

Session fixation

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 allows attackers to access the core log file and perform session hijacking via a crafted session token...

CVE-2022-34536

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 allows attackers to access the core log file and perform session hijacking via a crafted session token...

WordPress plugin BestWebSoft Contact Form cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...