CVE-2014-10400

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published: Feb 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-104016.1An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically CVE-2014-104026.1An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specificall CVE-2014-120110.0Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 ser CVE-2014-12029.3The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request param CVE-2014-12039.8The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacha CVE-2014-12047.5SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitra CVE-2014-12067.5SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary CVE-2014-12074.3VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepti CVE-2014-12083.3VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware CVE-2014-12099.3VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allow CVE-2014-12105.8VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-mid CVE-2014-12116.8Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentic