CVE-2026-40010: Session Fixation

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version...

Privilege escalation

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...

PT-2022-27419

Name of the Vulnerable Software and Affected Versions Ironman Software PowerShell Universal versions 2.x through 3.x prior to 2.12.6 Ironman Software PowerShell Universal versions 3.x prior to 3.4.7 Ironman Software PowerShell Universal versions 3.x prior to 3.5.3 Description The issue allows an...

CVE-2022-45183: Improper Privilege Management

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...