60045 matches found
CVE-2026-102367
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...
CVE-2026-102364
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...
PT-2026-102664
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...
PT-2026-102661
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...
CVE-2026-102630: Use of Less Trusted Source
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...
EUVD-2026-89362
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...
CVE-2026-79537
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...
PT-2026-102705
Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description The final form submission processes JSON arrays for each upload field but only verifies that IDs are numeric. Because client-supplied filenames and display names are trusted directly, the...
CVE-2026-79537
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...
CVE-2026-79537
metatool-ai MetaMCP versions through 2.4.22 are vulnerable to an Insecure Direct Object Reference (IDOR) in the MCP transport session dispatch. The root cause is that the session store (getSession in session-lifetime-manager.ts) is keyed solely by the client-supplied mcp-session-id header without...
CVE-2026-79537
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...
SUSE CVE-2026-67420
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...
CVE-2026-102367 mall4j through 4.0 Insufficient Session Expiration via Token Refresh
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...
CVE-2026-102367
The mall4j framework (versions through 4.0 ) is vulnerable to an insufficient session expiration issue within the token refresh endpoint . The root cause is a failure to validate the enabled flag when issuing new sessions via the POST /token/refresh endpoint. Consequently, users with disabled acc...
CVE-2026-102367 mall4j through 4.0 Insufficient Session Expiration via Token Refresh
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...
CVE-2026-102367 mall4j through 4.0 Insufficient Session Expiration via Token Refresh
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...
CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...
CVE-2026-102364
The mall4j framework (through version 4.0 ) contains an improper authentication vulnerability because it fails to validate the sysType field in sa-token sessions. This flaw allows storefront customers to authenticate as back-office users by reusing their own session tokens. An attacker who regist...
adaPwn
adaPwn - CVE-2019-14912 PoC El módulo OPENSSO de adAS no verifica correctamente el dominio al que redirigir, lo que permite redirigir al usuario a un sitio web controlado por un atacante, robando su cookie de sesión de adAS. Uso usage: adaPwn.py -h --interface INTERFACE --httpPort HTTPPORT...
CVE-2021-40223
CVE-2021-40223 Aplicación : Rittal CMC PU III Web management Dispositivos : CMC PU III 7030.000 Revisión de software : V3.11.002 Revisión de hardware : V3.00 Tipo de ataque : XSS Almacenado Solución : Actualizar a la revisión de software V3.17.10 o posterior Resumen : La aplicación web no sanitiz...