CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7675 – Potential Information Disclosure in Sentinel
https://notcve.org/view.php?id=CVE-2018-7675
In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. • https://www.netiq.com/support/kb/doc.php?id=7022706 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2011-1913
https://notcve.org/view.php?id=CVE-2011-1913
SQL injection vulnerability in the login form in the web interface in Mercator SENTINEL 2.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Una vulnerabilidad de inyección SQL en el formulario de acceso en la interfaz web de Mercator SENTINEL v2.0 permite a atacantes remotos ejecutar comandos SQL a través de vectores no especificados. • http://cert.netpeas.org/2011/06/cert-nps2011005-vulnerabilite-potentielle-dans-la-solution-de-gestion-de-la-securite-operationnelle-des-compagnies-aeriennes-%C2%AB-sentinel-safety-information-management-system-%C2%BB http://cert.netpeas.org/2011/06/cert-nps2011005-vulnerabilite-potentielle-dans-la-solution-de-gestion-de-la-securite-operationnelle-des-compagnies-aeriennes-suite http://secunia.com/advisories/46014 http://www.kb.cert.org/vuls/id/122142 http://www.securityfocus.com/bid/49638 https://exchange.xforce • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •