[20180507] - Core - Session deletion race condition

A long running background process, such as remote checks for core or extension updates, could create a race condition where a session which was expected to be destroyed would be recreated...

webSPELL 4 - Authentication Bypass

webSPELL 4 - Authentication Bypass Webspell Login Bypass Found by: h0yt3r Checklogin.php Line 60: setcookie"wsauth", $ds'userID'.":".$wspwd, time+$sessionduration6060; $login = 1; functions.php Line 253: $loginpercookie = false; ifisset$COOKIE'wsauth' AND !isset$SESSION'wsauth' $loginpercookie =...

Webspell 4 (Auth Bypass) SQL Injection Vulnerability

No description provided by source. Webspell Login Bypass Found by: h0yt3r Checklogin.php Line 60: setcookie"wsauth", $ds'userID'.":".$wspwd, time+$sessionduration6060; $login = 1; functions.php Line 253: $loginpercookie = false; ifisset$COOKIE'wsauth' AND !isset$SESSION'wsauth' $loginpercookie =...

CVE-2007-2836

Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename th...