584 matches found
CVE-2023-32997
The CVE-2023-32997 entry concerns the Jenkins CAS Plugin (versions 1.6.2 and earlier) that does not invalidate the existing session on login, enabling a session fixation risk. Multiple connected sources corroborate this behavior and describe it as allowing an attacker to potentially gain administ...
CVE-2023-28316
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled...
CVE-2020-4914
The CVE-2020-4914 issue affects IBM Cloud Pak System Software Suite 2.3.3.0–2.3.3.5, where sessions are not invalidated on logout, potentially allowing a local user to impersonate another user. This vulnerability concerns the logout/session handling component in IBM Cloud Pak System UI and REST A...
Session invalidation should be propagated to other nodes in the cluster
In Jira there are some events like password change, user delete which invalidates user sessions. Currently those events only invalidate sessions on the node where the event was triggered. Those events should be propagated to other nodes...
Jenkins plugins Multiple Vulnerabilities (2023-01-24)
According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - High Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are...
K51975973: Eclipse Jetty vulnerability CVE-2021-34428
Security Advisory Description For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can...
Security Bulletin: IBM MQ Appliance is vulnerable to improper session invalidation (CVE-2022-40230)
Summary IBM MQ Appliance has resolved an improper session validation vulnerability. Vulnerability Details CVEID:CVE-2022-40230 DESCRIPTION: IBM MQ Appliance does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. CVSS Base score:...
CVE-2023-24444
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login...
CVE-2023-24424
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login...
Information disclosure
Jenkins Azure AD Plugin 303.va91ef20ee49f and earlier does not invalidate the previous session on login...
Design/Logic Flaw
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login...
Design/Logic Flaw
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login...
Jenkins Plugin Bitbucket OAuth 授权问题漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
Jenkins Plugin OpenId Connect Authentication 授权问题漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
CVE-2023-24456
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...
CVE-2023-24424
CVE-2023-24424 affects the Jenkins OpenId Connect Authentication Plugin (versions 2.4 and earlier). The vulnerability arises because the plugin does not invalidate an existing session on login, enabling potential unauthorized access via social engineering or session fixation. Reported impact is h...
PT-2023-19587 · Jenkins · Jenkins Bitbucket Oauth Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket OAuth Plugin versions 0.12 and earlier Description: The issue arises because the Jenkins Bitbucket OAuth Plugin does not invalidate the previous session on login, which can lead to potential security risks. Recommendations:...
PT-2023-19586 · Jenkins · Jenkins Azure Ad Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Azure AD Plugin versions 303.va 91ef20ee49f and earlier Description: The issue is related to the Jenkins Azure AD Plugin not invalidating the previous session on login. This could potentially allow unauthorized access. Recommendations...