Ubuntu 21.04 : mod-auth-mellon vulnerability (USN-5069-2)

The remote Ubuntu 21.04 host has a package installed that is affected by a vulnerability as referenced in the USN-5069-2 advisory. USN-5069-1 fixed a vulnerability in mod-auth-mellon. This update provides the corresponding updates for Ubuntu 21.04. Tenable has extracted the preceding description...

CVE-2021-39501

EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function...

CVE-2021-39501

EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function...

Open redirect

EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function...

CVE-2021-39501

EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function...

CVE-2021-39501

EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function...

EyouCms 输入验证错误漏洞

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. An attacker can exploit this vulnerability to redirect users to malicious URLs via the logout feature...

Cross-Site Request Forgery (CSRF) in forkcms/forkcms

✍️ Description Attacker is able to logout a user if a logged in user visits attacker website. 🕵️‍♂️ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally you logged out //POC.html history.pushState'', '', '/' document.forms0.submit; 💥 Impact This...

CVE-2021-35342

The useradm service 1.14.0 in Northern.tech Mender Enterprise 2.7.x before 2.7.1 and 1.13.0 in Northern.tech Mender Enterprise 2.6.x before 2.6.1 allows users to access the system with their JWT token after logout, because of missing invalidation if the JWT verification cache is enabled...

CVE-2021-35342

The useradm service 1.14.0 in Northern.tech Mender Enterprise 2.7.x before 2.7.1 and 1.13.0 in Northern.tech Mender Enterprise 2.6.x before 2.6.1 allows users to access the system with their JWT token after logout, because of missing invalidation if the JWT verification cache is enabled...

CVE-2021-35342

The CVE-2021-35342 issue affects the useradm service in Northern.tech Mender Enterprise: version 1.14.0 (2.7.x line before 2.7.1) and 1.13.0 (2.6.x before 2.6.1) allow an authenticated user to continue accessing the system after logout when the JWT verification cache is enabled, due to missing in...

useradm 代码问题漏洞

useradm is a microservice used to manage user data and authentication in the Mender ecosystem. A security vulnerability exists in useradm that stems from service credentials not being invalidated, allowing users to access the system with their JWT token after logging out. The following products a...

Cross-Site Request Forgery (CSRF) in myvesta/vesta

✍️ Description Attacker is able to logout user if a logged in user visits attacker website. 🕵️‍♂️ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally you logged out history.pushState'', '', '/' document.forms0.submit; 💥 Impact This vulnerability is...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

CVE-2021-38554

A flaw was found in the vault package. The Vault UI web application may fail to completely clear a client-side data cache on user logout. As a result, an authenticated user sharing a browser to access Vault may have been able to view the previous authenticated user’s cached secrets, even if they...

CVE-2020-18701

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...

Improper access control

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...

PYSEC-2021-341

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...

PYSEC-2021-341

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...

CVE-2020-18701

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...