CVE-2022-22317

CVE-2022-22317 affects IBM Cúram Social Program Management 8.0.0–8.0.1. A code issue causes the session not to be invalidated after logout, enabling an authenticated user to impersonate another user. Connected sources (CNVD-2022-54649, IBM bulletin) confirm the root cause and affected versions, a...

IBM Curam Social Program Management 代码问题漏洞

IBM Curam Social Program Management is a business and technology solution from IBM that provides pre-built health and social program components, business processes, toolsets and interfaces on top of a dynamically configurable architecture. A code issue vulnerability exists in versions 8.0.0 and...

Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled...

Code injection

IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942...

IBM MQ Appliance 代码问题漏洞

IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. A code issue vulnerability exists in the IBM MQ Appliance, which stems from the IBM MQ appliance not invalidating a session after logging out, and could be exploited by an...

Design/Logic Flaw

In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks...

CVE-2021-25992

CVE-2021-25992 (Ifme) affects Ifme versions 1.0.0–7.33.2, where sessions aren’t properly invalidated after logout, enabling reuse of admin cookies via local/network or other attacks. The vulnerability stems from inadequate session invalidation, with high-severity impact (CVE entries report possib...

Ifme 代码问题漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. A code issue vulnerability exists in Ifme versions 1.0.0 through v.7.33.2 that stems from a failure to properly invalidate a user's session even after the user...

CVE-2021-25992

In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks...

CVE-2021-39066

IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040...

CVE-2021-37866

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization...

CVE-2021-37866

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization...

Authorization

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization...

CVE-2021-37866

Mattermost Boards plugin (v0.10.0 and earlier) does not invalidate server-side sessions on user logout, allowing reuse of the old session token for authorization. Documented as CVE-2021-37866 with multiple references (NVD, CVE lists, and country/NVD mirrors). Relevant impact details indicate netw...

Shopware 代码问题漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware.A trust management issue vulnerability exists in versions of Shopware prior to 5.7.7, which stems from the fact that shopware does not invalidate a user's session when a password is changed. An attacker could...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

Insecure Cookie Handling

symfony/security-bundle vulnerable to Insecure Cookie Handling attacks. The vulnerability exists because the remember me cookie does not properly invalidate the session after the password change. An attacker could use this flaw to steal sensitive user information and gain access to the applicatio...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...