SUSE CVE-2024-50086

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add sessionlock when setting SMB2SESSIONEXPIRED and...

IoT Haat Smart Plug IH-IN-16A-S 安全漏洞

IoT Haat Smart Plug IH-IN-16A-S is a smart plug from IoT Haat. A security vulnerability exists in IoT Haat Smart Plug IH-IN-16A-S version v5.16.1, which stems from the presence of a session expiration insufficiency issue and lack of validation of authentication tokens, which could lead to an...

CVE-2024-32006

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 SP2. The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authentication...

The vulnerability of the OpenVPN software lies in the lack of resource release after the expiration of its duration. This allows a hacker to “keep the session alive,” even if the server is instructed to disconnect this client.

The vulnerability of the OpenVPN software is related to the lack of resource release after the expiration of its duration. Exploiting this vulnerability allows a hacker to “keep the session alive,” even if the server was instructed to disconnect this client...

CVE-2024-27782

Multiple insufficient session expiration weaknesses CWE-613 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests...

Multiple vulnerabilities in NEC Aterm series

Overview Aterm series provided by NEC Corporation contains multiple vulnerabilities listed below. Incorrect Permission Assignment for Critical Resource CWE-732 - CVE-2024-28005 Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 - CVE-2024-28006 Incorrect Permission...

Dell PowerScale OneFS 代码问题漏洞

Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. A code issue vulnerability exists in Dell PowerScale OneFS that stems from the presence of a session expiration vulnerability that can be exploited by an...

CVE-2024-0943

A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attack can be launched remotely. The complexity of an attac...

PT-2024-1361 · Totolink · Totolink N200Re

Name of the Vulnerable Software and Affected Versions: Totolink N200RE V5 version 9.3.5u.6255 B20211224 Description: The issue is related to the /cgi-bin/cstecgi.cgi file in the Totolink N200RE router's firmware, specifically concerning incorrect session expiration. This can allow a remote attack...

Engineers Online Portal Code Issue Vulnerability

Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. A code issue vulnerability exists in Engineers Online Portal version 1.0. An attacker could exploit this vulnerability to...

Elenos ETG150 Security Vulnerability

The Elenos ETG150 is an FM transmitter from Elenos. A security vulnerability exists in the Elenos ETG150 FM Transmitter version v3.12, which stems from an insufficient session expiration time and allows an attacker to arbitrarily change configuration and data after logging out...

Fortinet FortiEDR 代码问题漏洞

Fortinet FortiEDR is an endpoint security solution built from the ground up by Fortinet. Fortinet FortiEDR suffers from an Access Control Error vulnerability that stems from insufficient handling of session expiration times, which can be exploited by an attacker to execute unauthorized code or...

PT-2023-27219 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 2.6.0 through 2.6.13 Argo CD versions 2.7.0 through 2.7.11 Argo CD versions 2.8.0 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The issue arises from open web terminal sessions not...

Cal.com 代码问题漏洞

Cal.com is an open source scheduling software from Cal.com Open Source. A code issue vulnerability exists in Cal.com that stems from old sessions not expiring when 2FA is enabled...

GHSA-3FQM-FRHG-7C85 Graylog user session is still usable after logout

Summary In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Details Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the...

IBM Cognos Analytics 代码问题漏洞

IBM Cognos Analytics is a suite of business intelligence software from International Business Machines IBM. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. An Access Control...

PT-2023-17286 · Unknown · Sourcecodester Online Graduate Tracer System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Graduate Tracer System version 1.0 Description: A problematic issue was found in the system, affecting an unknown function of the file admin/. This issue leads to session expiration and can be exploited remotely. The...

answer 代码问题漏洞

answer is an open source knowledge-based community software. An access control error vulnerability exists in versions of answer prior to 1.0.6 that stems from insufficient session expiration. An attacker could exploit the vulnerability by using a token to gain unauthorized access to an applicatio...

SUSE CVE-2018-17199

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...

SUSE CVE-2019-11778

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...