Security Bulletin: Multiple vulnerabilities affect PowerSC and PowerSC MFA

Summary There are multiple vulnerabilities in PowerSC and PowerSC MFA. Vulnerability Details CVEID:CVE-2023-50939 DESCRIPTION: IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID:...

CVE-2024-49825

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2025-24859

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This...

CVE-2025-24859 Apache Roller: Insufficient Session Expiration on Password Change

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This...

Apache Roller 代码问题漏洞

Apache Roller is the United States Apache Apache Foundation of a Java-based multi-user open source blogging system. A code issue vulnerability exists in Apache Roller 6.1.4 and earlier versions, which stems from a password change that does not properly invalidate the session and can be exploited ...

PT-2025-16242 · Ibm · Ibm Robotic Process Automation For Cloud Pak +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.20 IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.20 Description: The issue...

CVE-2024-25051

IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system...

CVE-2024-25051

IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system...

PT-2025-14507 · Ibm · Ibm Jazz Reporting Service

Name of the Vulnerable Software and Affected Versions: IBM Jazz Reporting Service versions 7.0.2 through 7.0.3 Description: The issue allows an authenticated privileged user to impersonate another user on the system because the session is not invalidated after logout. Recommendations: For version...

Hiro: Logout Bypass Vulnerability in Hiro.so

Summary A logout bypass vulnerability has been identified on platform.hiro.so, allowing users to regain access to their session after logging out simply by pressing the back button on the browser. This issue arises due to improper session invalidation and potential caching misconfigurations. If...

Security Bulletin: IBM DataPower Gateway does not invalidate active sessions on a password change (CVE-2022-40228)

Summary If a user password is changed, IBM DataPower Gateway does not immediately invalidate existing active sessions that were created with the old password. This means that a session created using a compromised password could continue to operate after the password has been changed until the...

SUSE CVE-2025-1412

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

Session Fixation

github.com/mattermost/mattermost-server is vulnerable to Session Fixation. The vulnerability is due to improper session invalidation when converting a user to a bot, allows the user to retain their previous session and potentially escalate privileges based on the bot’s assigned permissions...

Mattermost Server 9.11.x < 9.11.7 / 10.4.x < 10.4.2 (MMSA-2025-00414)

The version of Mattermost Server installed on the remote host is prior to 9.11.7 or 10.4.2. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00414 advisory. - Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a...

Vulnerabilities fixed in Mattermost

Mattermost fixed vulnerabilities in versions 10.4.x, 9.11.x, 10.3.x, 10.2.x and 10.1.x. The vulnerabilities include failure to invalidate active sessions when converting to a bot, incorrect input validation during board patching and duplication, SQL injection attacks due to lack of prepared...

Mattermost fails to invalidate all active sessions when converting a user to a bot

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

GHSA-RHVR-6W8C-6V7W Mattermost fails to invalidate all active sessions when converting a user to a bot

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

CVE-2025-1412 Session Persistence After User-to-Bot Conversion

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from insufficient session invalidation, leading to elevation of privilege...

CVE-2024-45386

A vulnerability has been identified in SIMATIC PCS neo V4.0 All versions, SIMATIC PCS neo V4.1 All versions V4.1 Update 2, SIMATIC PCS neo V5.0 All versions V5.0 Update 1, SIMOCODE ES V19 All versions V19 Update 1, SIRIUS Safety ES V19 TIA Portal All versions V19 Update 1, SIRIUS Soft Starter ES...