Insecure Session Management

moodle/moodle uses an insecure session management. The session tokens are not invalidated or removed upon a successful password change...

Synology DiskStation Manager Information Disclosure Vulnerability

Synology DiskStation Manager DSM is a product of Synology Inc. of Taiwan, China DSM, etc. Synology DiskStation Manager is a set of operating systems for use on networked storage servers NAS.HTTPS Hypertext Transfer Protocol Secure, etc. are products of HTTPS, a web-based secure transfer protocol,...

Insecure Session Management

cfme2 uses insecure session management. An attacker is able to perform session tampering attacks using the secret in the static secrettoken.rb...

Insecure Session Cookie

cups uses an easy-to-guess session cookie. This allows an attacker to guess the cookie value and gain access to the web interface...

Security update for gnutls (important)

openSUSE Security Update: Security update for gnutls Announcement ID: openSUSE-SU-2020:0790-1 Rating: important References: 1172461 1172506 Cross-References: CVE-2020-13777 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

SMACom 1.2.0 Insecure Transit / Password Disclosure

Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-16 Vulnerability Laboratory ID VL-ID: ====================================...

SMACom v1.2.0 - Insecure Session Validation Vulnerability

Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-15 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2015-0102

CVE-2015-0102 affects IBM Workflow for Bluemix. The vulnerability arises because the session cookie is not marked Secure in HTTPS, enabling network attackers to potentially capture the cookie during transmission over HTTP. NVD lists CVSS‑3.1 base score 8.1 (High) and CVSS‑2 base score 5.8 (Medium...

Insecure Session Management

infinispan spring-core contains insecure session management. In AbstractInfinispanSessionRepository.java, when getId returns a different value from getOriginalId, the original session is not deleted. An attacker can reuse the original ID to gain access to the application as the user...

CVE-2019-11540

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack...

Insecure Session Management

flarum/core contains an insecure session management. A lack of expiry and invalidation in the user email tokens allows a remote attacker to reuse the email tokens belonging to users to gain access to the application...

CVE-2019-11213

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. The endpoint would need to be already compromised for exploitation to succeed...

CVE-2019-3784

CVE-2019-3784 affects Cloud Foundry Stratos prior to version 2.3.0 . The issue is an insecure session that can be spoofed when hosted on Cloud Foundry with multiple instances using the default embedded SQLite database, allowing a remote authenticated attacker to switch sessions to another user sh...

Design/Logic Flaw

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id...

CVE-2019-7336

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view monitorfilters.php contains takes in input from the user and saves it into the session, and retrieves it later insecurely. The values of the MonitorName and Source parameters are being displayed without any...

CVE-2019-7336

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view monitorfilters.php contains takes in input from the user and saves it into the session, and retrieves it later insecurely. The values of the MonitorName and Source parameters are being displayed without any...

Security Bulletin: IBM API Connect Developer Portal is affected by Insecure Session Management in Drupal

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: Not Applicable DESCRIPTION: Session Limit module for Drupal could allow a remote attacker to obtain sensitive information, caused by improper tokenize of the list of sessions. By inspecting the forms, ...

Session Limit - Critical - Insecure Session Management - SA-CONTRIB-2018-072

The session limit module enables a site administrator to set a policy around the number of active sessions users of the site may have. This is typically set to one so that you can only be logged in once with the same user account. In one configuration of the module, when a user logs in with anoth...

CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...

Design/Logic Flaw

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture...