An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSysax Multi Server
APPSysax6.90
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Powiązane podatności
CVE-2012-10060CRITICAL9.3PL ✓ten sam produkt
Stack-based buffer overflow w SSH Sysax Multi Server – RCE bez uwierzytelnienia
CVE-2013-10065HIGH8.7ten sam produkt
A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially cr...
CVE-2024-53458HIGH7.5ten sam produkt
Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted...
CVE-2012-6530HIGH7.1ten sam produkt
Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticat...
CVE-2009-4790HIGH9.0ten sam produkt
Multiple directory traversal vulnerabilities in Sysax Multi Server 4.5 allow remote authenticated users to rea...