1386 matches found
CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup
Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...
Insufficient Session Expiration
Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests...
CVE-2023-40732
A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...
Siemens QMS Automotive 代码问题漏洞
Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. A code issue vulnerability exists in Siemens QMS Automotive, which stems from the affected application's QMS.Mobile module not invalidating session tokens upon logout. An attacker could exploi...
Session fixation
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database for database session backen...
PYSEC-2023-158
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database for database session backen...
CVE-2023-40273 Session fixation in Apache Airflow web interface
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database for database session backen...
Session Fixation in Guardian/CMC before 22.6.2
Summary In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session. Impact Unauthorized...
CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be abused if a Kirby user is logged in on a device or browser th...
CLSA-2023-1690294029 kernel: Fix of 29 CVEs
ALSA: pcm: Fix races among concurrent prealloc proc writes CVE-2022-1048 - ALSA: pcm: Fix races among concurrent prepare and hwparams/hwfree calls CVE-2022-1048 - ALSA: pcm: Fix races among concurrent read/write and buffer changes CVE-2022-1048 - ALSA: pcm: Fix races among concurrent hwparams and...
PT-2025-53169
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the KVM component related to the s390 virtualization platform. Specifically, an incorrect index value can be assigned to a replaced ASCE Address...
CVE-2023-3591 Lack of previous password reset tokens on new token creation
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created...
Mattermost 授权问题漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from the fact that all previous tokens are not invalidated when a new reset token is created...
PT-2023-25374 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue is related to Mattermost failing to invalidate previously generated password reset tokens when a new reset token is created. This allows potentially unauthorized access through...
CVE-2023-37946
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the previous session on login...
CVE-2023-37946
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the previous session on login...
CVE-2023-37946
CVE-2023-37946 concerns the Jenkins OpenShift Login Plugin (versions up to 1.1.0.227.v27e08dfb_1a_20 and earlier) where login does not invalidate the previous session, enabling session fixation. The CVSSv3.1 base score is 8.8 (HIGH) with NETWORK attack vector, user interaction required. Red Hat a...
CVE-2023-25751
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...
DEBIAN-CVE-2023-25751
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...
CVE-2023-25751
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...