CVE-2018-19443

MEDIUM Year: 2018
CVSS v3 Score
5.9
Medium
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-384
View all →

Vulnerability Description

The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.

Related Vulnerabilities

CVE-2017-10600

MEDIUM
CVSS:5.9(Medium)

ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same...

CWE-3842017

CVE-2017-5831

MEDIUM
CVSS:5.9(Medium)

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.

CWE-3842017

CVE-2018-1000173

MEDIUM
CVSS:5.9(Medium)

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can contr...

CWE-3842018

CVE-2018-1000602

MEDIUM
CVSS:5.9(Medium)

A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-a...

CWE-3842018

CVE-2019-1003019

MEDIUM
CVSS:5.9(Medium)

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can...

CWE-3842019

CVE-2019-15612

MEDIUM
CVSS:5.9(Medium)

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.

CWE-3842019