CVE-2022-22283

Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App...

Design/Logic Flaw

Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App...

Samsung Health 代码问题漏洞

Samsung Health is a health management app for Samsung Samsung mobile devices. An improper session management vulnerability exists in Samsung Health versions prior to 6.20.1.005, which stems from a Samsung Health account not being logged out after a user is removed from an inactive device. An...

CVE-2022-22283

Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App...

CVE-2022-22283

Samsung Health suffers from an improper session management vulnerability that prevents logging out. Multiple connected sources indicate affected versions are prior to 6.20.1.005. The issue stems from session handling that could allow access to sensitive data after account status changes or device...

Insecure Session Management

shopware/shopware uses an insecure session management. The library does not invalidate session tokens after the user password change, allowing an attacker to gain access to the system if an old session token was obtained...

CVE-2021-20151

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker whether from a different computer,...

CVE-2021-20151

CVE-2021-20151 affects Trendnet AC2600 TEW-827DRU (firmware 2.08B01). The root cause is session management that relies on IP address rather than validating cookies/session tokens, enabling session takeover if the attacker can spoof or take over the original IP. The CVSS vectors indicate network a...

CVE-2021-20151

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker whether from a different computer,...

Fresenius Kabi Agilia Connect Infusion System Licensing Issue Vulnerability

An authorization issue vulnerability exists in the Fresenius Kabi Agilia Connect Infusion System, an infusion system from the German company Fresenius Kabi, which stems from the product's client-side implementation of only authentication and session management mechanisms. No detailed vulnerabilit...

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software, related to session management errors, allows a intruder to gain unauthorized access to the device.

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software is related to session management errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the device remotely...

The vulnerability in the web interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unified Communications Manager IM & Presence Service allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of the Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unified Communications Manager IM & Presence Service web interfaces is related to the manipulation of inter-site requests. Exploiting this vulnerability allows...

Insecure Session Management

apostrophe uses insecure session management. The session object does not exist in task requests, allowing a malicious user to hijack logged-in user's sessions recently...

CVE-2021-2477

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Session Management. Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2021-2477

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Session Management. Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2021-2477

CVE-2021-2477 affects Oracle E-Business Suite, Oracle Applications Framework (Session Management). Affected: 12.1.3 and 12.2.3–12.2.10. An unauthenticated, network-accessible attacker over HTTP can cause partial denial of service to the framework. CVSS v3.1 base 5.3 (A). Documents corroborate; no...

Oracle E-Business Suite Denial of Service Vulnerability (CNVD-2022-02347)

Oracle E-Business Suite is an extension of the original Application ERP, including ERP enterprise resource planning management, HR human resource management, CRM customer relationship management and other collections of management software, a seamlessly integrated management suite. Oracle...

Oracle E-Business Suite和Oracle Applications Framework 安全漏洞

Oracle E-Business Suite is an extension of the original Application ERP, including ERP enterprise resource planning management, HR human resource management, CRM customer relationship management and other collections of management software, a seamlessly integrated management suite. Oracle...

Sensitive Cookie Without 'HttpOnly' Flag in craigk5n/webcalendar

✍️ Description HTTPOnly attribute is not set for session cookies in the application 💥 Impact When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These include session cookies that can make it easier to...

CVE-2021-35214 Session Management Vulnerability

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...