CVE-2019-15955

An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead of O(n)=n^x complexity, and steal the admin password.

• CWE-327
• CWE-330

• https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdfExploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Sep/3Exploit, Mailing List, Third Party Advisory
• https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdfExploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Sep/3Exploit, Mailing List, Third Party Advisory

Published

Sep 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15949Nagios XI before 5.6.6 allows remote command execution as ro…8.8
• CVE-2019-1595A vulnerability in the Fibre Channel over Ethernet (FCoE) pr…7.4
• CVE-2019-15950The CRM Plugin before 4.2.4 for Redmine allows XSS via craft…6.1
• CVE-2019-15952An issue was discovered in Total.js CMS 12.0.0. An authentic…
• CVE-2019-15953An issue was discovered in Total.js CMS 12.0.0. An authentic…
• CVE-2019-15954An issue was discovered in Total.js CMS 12.0.0. An authentic…9.9
• CVE-2019-15956A vulnerability in the web management interface of Cisco Asy…8.8
• CVE-2019-15957A vulnerability in the web-based management interface of cer…7.2
• CVE-2019-15958A vulnerability in the REST API of Cisco Prime Infrastructur…9.8
• CVE-2019-15959A vulnerability in Cisco Small Business SPA500 Series IP Pho…6.6
• CVE-2019-1596A vulnerability in the Bash shell implementation for Cisco N…7.8
• CVE-2019-15960A vulnerability in the Webex Network Recording Admin page of…5.4