1386 matches found
CVE-2022-38382
IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. IBM X-Force ID: 233672...
CVE-2022-38382
IBM Cloud Pak for Security (CP4S) 1.10.0.0–1.10.11.0 and IBM QRadar Suite Software 1.10.12.0–1.10.23.0 do not invalidate sessions after logout, potentially allowing another authenticated user to obtain sensitive information. This CVE-2022-38382 is corroborated by IBM/X-Force sources and Red Hat's...
CVE-2023-38018
IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574...
CVE-2023-38018
IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574...
CVE-2023-26288
IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477...
IBM Aspera Orchestrator 代码问题漏洞
IBM Aspera Orchestrator is a Web-based application from International Business Machines IBM, Inc. It can provide an efficient file processing pipeline for data-driven organizations. A code issue vulnerability exists in IBM Aspera Orchestrator version 4.0.1 that stems from not invalidating a sessi...
UBUNTU-CVE-2024-41083
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfspagemkwrite to check folio-mapping is valid Fix netfspagemkwrite to check that folio-mapping is valid once it has taken the folio lock as filemappagemkwrite does. Without this, generic/247 occasionally oopses with...
Security Bulletin: IBM Aspera Orchestrator improved security for user session handling (CVE-2023-26288, CVE-2023-38001)
Summary IBM Aspera Orchestrator has addressed multiple vulnerabilities related to user session handling. Vulnerability Details CVEID:CVE-2023-38001 DESCRIPTION: IBM Aspera Orchestrator is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized...
kernel: kvm: Avoid potential UAF in LPI translation cache
A flaw was found in the Linux kernel pertaining to a potential use-after-free UAF scenario in a system involving Logical Partitioning Interrupts LPI translation cache operations. Specifically, the issue arises when a cache hit occurs concurrently with an operation that invalidates the cache, such...
CVE-2024-29070
CVE-2024-29070 affects Apache StreamPark where versions prior to 2.1.4 fail to invalidate sessions after logout. The root cause is improper session management: after a successful login, the Backend service returns an Authorization credential that remains usable to initiate requests and access dat...
CVE-2024-29070 Apache StreamPark: session not invalidated after logout
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users...
Insecure Direct Object Reference (IDOR)
github.com/drakkan/sftpgo is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to the lack of proper security measures such as JWT ID JTI claims, nonces, and proper expiration and invalidation mechanisms. The vulnerability allows an attacker with a valid intercepted...
Withdrawn: SFTPGo's JWT implmentation lacks certain security measures
Withdrawn: The attack vector described in the backing report required that an attacker gain access to a user's session cookie. By gaining access to the session cookie the attacker is for all intents and purposes the valid user and any access to user data would be expected. In SFTPGo 2.6.2, the JW...
GHSA-X72P-G37Q-4XR9 Withdrawn: SFTPGo's JWT implmentation lacks certain security measures
Withdrawn: The attack vector described in the backing report required that an attacker gain access to a user's session cookie. By gaining access to the session cookie the attacker is for all intents and purposes the valid user and any access to user data would be expected. In SFTPGo 2.6.2, the JW...
CVE-2024-40430
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
DEBIAN-CVE-2024-40927
In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset...
Incorrect Authorization
github.com/drakkan/sftpgo is vulnerable to Incorrect Authorization. The vulnerability is due to a lack of session invalidation when a user or admin changes their password, which allows an attacker to regain access to restricted accounts by resetting the accounts password. Note that this...
DEBIAN-CVE-2022-48724
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix potential memory leak in intelsetupirqremapping After commit e3beca48a45b "irqdomain/treewide: Keep firmware node unconditionally allocated". For tear down scenario, fn is only freed after fail to allocate irdomai...
Incorrect Authorization
org.apache.submarine, submarine-server-core is vulnerable to an Incorrect Authorization. The vulnerability is due to invalidation on authorization checks, allowing unauthorized users to potentially gain access to restricted functionalities...