Security Bulletin: Financial Transaction Manager for Check Services is affected by a potential logout session timeout (CVE-2020-4555)

Summary Login session may not be invalidated in a timely manner on timeout. Vulnerability Details CVEID: CVE-2020-4555 DESCRIPTION: IBM Financial Transaction Manager for High Value Payments for Multi-Platform does not invalidate session after logout which could allow an authenticated user to...

[SECURITY] Fedora 31 Update: dbus-1.12.18-1.fc31

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

Unspecified Vulnerability in Saml2 Authentication services for ASP.NET

Saml2 Authentication services for ASP.NET is a SAML Security Assertion Markup Language authentication service for ASP.NET. A security vulnerability exists in the method of token authentication in Saml2 Authentication services for ASP.NET versions 1.0.2 and 2.0.0 through 2.6.0. An attacker could...

CVE-2020-5268

In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is...

CVE-2020-5268: Incorrect Implementation of Authentication Algorithm

In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is...

CVE-2019-1172

An information disclosure vulnerability exists in Azure Active Directory AAD Microsoft Account MSA during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into...

Information disclosure

An information disclosure vulnerability exists in Azure Active Directory AAD Microsoft Account MSA during the login request session, aka 'Windows Information Disclosure Vulnerability'...

PT-2019-3007 · Microsoft · Azure Active Directory +1

Name of the Vulnerable Software and Affected Versions: Azure Active Directory AAD Microsoft Account MSA affected versions not specified Description: An information disclosure issue exists in Azure Active Directory AAD Microsoft Account MSA during the login request session, allowing an attacker to...

WordPress Satoshi Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. Cross-site request forgery vulnerability exists in WordPress Satoshi, where an attacker,...

CVE-2018-10252

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its...

Airtame HDMI dongle session fixation vulnerability

The AIRTAME HDMI dongle is a wireless access point product for connecting, sharing and split-screen TVs or monitors. A security vulnerability exists in the /bin/login.php file of the Web Panel in the Airtame HDMI dongle using firmware versions prior to 3.0. The vulnerability can be exploited by a...

WordPress FormCraft Form Builder Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress FormCraft Form Builder. An attacker can exploit this vulnerability t...

SAP Customer Relationship Management Cross-Site Scripting Vulnerability

SAP Customer Relationship Management is a customer relationship management solution. A cross-site scripting vulnerability exists in SAP Customer Relationship Management. An attacker could exploit this vulnerability to obtain user login session information...

Session Information Disclosure

github.com/grafana/grafana is vulnerable to session information disclosure. Cookies are not generated with the secure flag, this allows malicious actors to steal login session information over insecure connections...

Authentication Logic Error Vulnerability in Weetop CMS Backend

Weetop CMS is a web content management system developed by Hangzhou Tintop Technology Co. Weetop CMS V2.0 has an authentication logic error vulnerability in the login function, as a login session is created before a successful login. An attacker can successfully access the backend by performing...

Authentication Bypass Vulnerability in Weetop CMS Backend

Weetop CMS is a web content management system developed by Hangzhou Tintop Technology Co. An authentication bypass vulnerability exists in the Weetop CMS V2.0 administration backend in the login session check processing mechanism. An attacker can bypass the forced jump without login by disabling...

[SECURITY] Fedora 24 Update: dbus-1.11.6-1.fc24

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

Hacker finds flaws that could let anyone steal $25 Billion from a Bank

A security researcher could have stolen as much as $25 Billion from one of the India's biggest banks ‒ Thanks to the bank's vulnerable mobile application. Late last year, security researcher Sathya Prakash discovered a number of critical vulnerabilities in the mobile banking application of an...

The vulnerability of the Isilon operating system OneFS, which allows a hacker to bypass the SmartLock restriction

The vulnerability of the Isilon operating system OneFS is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent the SmartLock restriction by creating a user account and setting up an login session remotely...

Code injection

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for...