PT-2024-71: Predictable format of user identifiers in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. Web application uses an unreliable algorithm for generating user account IDs. As a result, an intruder can predict existing identifiers within the application to carry out attacks targeting the authentication mechanism...

PT-2024-73: Unlimited session lifetime in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application does not limit the storage time of the session identifier or credentials, or this time is excessively long. An attacker can reuse old credentials or session identifiers to log in as another user and gain...

PT-2024-41024 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher affected versions not specified Description: The issue is related to incorrect session expiration limitation in the Password Pusher web service, which allows information to be transmitted via temporary links. This could enable...

PT-2024-37046 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions 1.50.3 and prior Description: A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session tok...

PT-2024-35447 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions prior to v1.49.0 Description: The issue is related to the rate limiter in Password Pusher, which can be bypassed by forging proxy headers, allowing bad actors to send unlimited traffic to the site and potentially...