GHSA-G9V2-WQCJ-J99G Uptime Kuma has Persistentent User Sessions

Summary Attackers with access to a users' device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods. Details uptime-kuma sets JWT tokens for users after successful authentication. These tokens have...

CVE-2023-44400

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the...

Session fixation

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the...

CVE-2023-44400

Affected product: Uptime Kuma (self-hosted monitoring tool). Vulnerability: Prior to version 1.23.9, changing a user’s password did not revoke existing sessions, allowing previously logged-in users to retain access; this stems from missing verification of session tokens after password changes/ina...

CVE-2023-44400 Uptime Kuma has Persistentent User Sessions

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the...

CVE-2023-44400 Uptime Kuma has Persistentent User Sessions

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the...

JetBrains TeamCity < 2023.05.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2023.05.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access CVE-2023-39173 - In JetBrains TeamCity...

Cleaning Business Software Security Vulnerability

Cleaning Business Software is an open source cleaning business software by PHPJabbers. PHPJabbers Cleaning Business Software version 1.0 has a security vulnerability , the vulnerability stems from the user password is not encrypted , an attacker can access all user accounts...

PT-2023-27790 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions prior to 10.0.3 Zimbra Collaboration ZCS versions 9.0.0 before Patch 35 Zimbra Collaboration ZCS versions 8.8.15 before Patch 42 Description: An issue was discovered in Zimbra Collaboration, allowing an...

CVE-2023-26445

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and...

PT-2023-20627 · Open Xchange · Open-Xchange Appsuite

Name of the Vulnerable Software and Affected Versions: Open-Xchange App Suite affected versions not specified Description: Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed...

JetBrains TeamCity elevation of privilege vulnerability (CNVD-2023-62626)

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A privilege vulnerability exists in JetBrains...

CVE-2023-39173

In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access...

CVE-2023-39173

In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access...

CVE-2023-39173

In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access...

Advisory ROSA-SA-2023-2181

Software: Grafana 6.7.4 OS: ROSA Virtualization 2.1 packageevrstring: grafana-6.7.4-3.rv3.src.rpm CVE-ID: CVE-2023-3128 BDU-ID: 2023-03343 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the Grafana web-based data submission tool is related to authentication bypass via spoofing. Exploitation of...

The vulnerability of the Grafana data visualization web tool, related to bypassing authentication through spoofing, allows attackers to gain full access to the user account.

The vulnerability of the Grafana data visualization web tool is related to the ability to bypass authentication through spoofing. Exploiting this vulnerability can allow a malicious actor to gain full access to the user account...

Vulnerability fixed in TOPdesk

TOPdesk has fixed a vulnerability in TOPdesk Self-service and TOPdesk Operator. A malicious party with a valid account can exploit the exploit the vulnerability to impersonate any other user and thus gain access to and manipulate their data. manipulate. The vulnerability lies in the way SAML Sing...

Apache InLong Weak Password Vulnerability

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. A security vulnerability exists in Apache InLong versions 1.1.0 through 1.6.0, which stems from an application that does not set a complexity requirement for user passwords, and can be...

Apache OpenMeetings vulnerable to remote code execution via null-bye injection

An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0...