1801 matches found
GHSA-6XHF-X49C-M5M6 Github Token Leak in aegir
Affected versions of aegir bundle and publish the current users github token to npm when aegir-release is executed. Recommendation Update to version 12.0.8 or later. If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked...
Cross site request forgery (csrf)
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...
CVE-2018-11406
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...
CVE-2018-11475
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...
CVE-2018-6088
An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file...
PT-2018-17358
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117 Opera versions prior to 66.0.3359.117 Description The issue is related to an iterator-invalidation bug in PDFium, which allows a remote attacker to execute arbitrary code inside a sandbox via a...
Authorization Bypass
python-keystoneclient is vulnerable to authorization bypass via token reuse. The vulnerability exists as authorization tokens were not invalidated when it was supposed to...
SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2017:2937-1)
This update for sssd provides the following fixes: Security issues fixed : - CVE-2017-12173: Fixed unsanitized input when searching in local cache database bsc1061832. Non security issues fixed : - Fixed a segfault issue in ldaprfc2307fallbacktolocalusers. bsc1055123 - Install /var/lib/sss/mc...
Default credentials
Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a password change...
CVE-2017-1000136
CVE-2017-1000136 affects Mahara 1.8 before 1.8.6, 1.9 before 1.9.4, 1.10 before 1.10.1, and 15.04 before 15.04.0. The root cause is that old sessions are not invalidated after a password change, enabling continued access to an account post-change. Affected versions and the exact vulnerability are...
CVE-2017-9933
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents...
CVE-2017-9933
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents...
Input validation
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents...
CVE-2017-9933
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents...
CVE-2017-9933
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents...
PT-2017-19296
Name of the Vulnerable Software and Affected Versions Joomla! CMS versions 1.7.3 through 3.7.2 Description The issue is related to improper cache invalidation, which can lead to the disclosure of form contents. Recommendations For Joomla! CMS versions 1.7.3 through 3.7.2, update to a version that...
CVE-2017-9933: Exposure of Sensitive Information to an Unauthorized Actor
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents...
X (Formerly Twitter): [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailable
First of all, really sorry for the unintentional DoS : I was testing it with a fresh bearer token but copied the production one accidentally. Details I've noticed that TweetDeck is using OAuth2 to issue requests Authorization Bearer token: http GET...
CVE-2016-9703
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information...