CVE-2023-31238

MEDIUM Year: 2023
CVSS v3 Score
4.8
Medium
Weakness Type
CWE-732
View all →

Vulnerability Description

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.60), POWER METER SICAM Q100 (All versions < V2.60), POWER METER SICAM Q100 (All versions < V2.60), POWER METER SICAM Q100 (All versions < V2.60). Affected devices are missing cookie protection flags when using the default settings. An attacker who gains access to a session token can use it to impersonate a legitimate application user.

Related Vulnerabilities

CVE-2021-21494

MEDIUM
CVSS:4.8(Medium)

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly.

CWE-7322021

CVE-2017-0913

MEDIUM
CVSS:4.7(Medium)

Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Succe...

CWE-7322017

CVE-2017-1000461

MEDIUM
CVSS:4.7(Medium)

Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being a...

CWE-7322017

CVE-2017-9079

MEDIUM
CVSS:4.7(Medium)

Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is rea...

CWE-7322017

CVE-2018-5516

MEDIUM
CVSS:4.7(Medium)

On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.0...

CWE-7322018

CVE-2020-15910

MEDIUM
CVSS:4.7(Medium)

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a p...

CWE-7322020