Cisco FTD Software Pluggable Authentication Module DoS (cisco-sa-20191002-ftd-fpmc-dos)

According to its self-reported version, Cisco Firepower Threat Defense FTD Software is affected by a vulnerability in the configuration of the Pluggable Authentication Module PAM due to improper resource management in the context of user session management. An authenticated, remote attacker can...

The vulnerability of the web interface of Belden Hirschmann’s network switches models RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS allows a intruder to gain unauthorized access and intercept web sessions.

The vulnerability of Belden Hirschmann’s network switch web interfaces for models series RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS is related to improper session management. Exploiting this vulnerability can allow an attacker to gain unauthorized access and intercept web sessions...

GRANDIT Session Management Vulnerability

GRANDIT is a Web-based ERP Enterprise Resource Planning system from GRANDIT Japan. The system includes functions such as sales management, financial management and human resource management. A security vulnerability exists in GRANDIT, which stems from the program not properly managing sessions. A...

CVE-2020-5539

GRANDIT Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0 do not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and then alter or disclose the information via unspecified vectors...

Design/Logic Flaw

GRANDIT Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0 do not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and then alter or disclose the information via unspecified vectors...

CVE-2020-5539

GRANDIT Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0 do not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and then alter or disclose the information via unspecified vectors...

CVE-2020-5539

CVE-2020-5539 affects GRANDIT: Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0. The issue is improper session management that allows a remote attacker to impersonate an arbitrary user and then alter or disclose information via unspecified vectors. Connected sources (Red Hat, CNVD, JVN, C...

GRANDIT vulnerable to session management

Overview GRANDIT provided by GRANDIT CORPORATION contains a vulnerability in session management CWE-639. Kazuki Mitobe of FUJISOFT INCORPORATED reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A user who can...

JVN#73472345: GRANDIT vulnerable to session management

GRANDIT provided by GRANDIT CORPORATION contains a vulnerability in session management CWE-639. Impact A user who can access to the product may impersonate an arbitrary user. As a result, information may be altered or disclosed. Solution Apply the Patch Apply the appropriate patch according to th...

WakaTime: Broken Authentication and session management OWASP A2

Hi, Security Team! i found vulnerability on https://wakatime.com/ Steps To Reproduce: 1. First log in into the account, website will create a session for current login. 2. Copy all Cookies and paste it on notepad. 3. Log out your account. 4. Open your chrome browser and right click on bookmark ba...

Insecure Session Management

Symfony uses an insecure session management. An attacker is able to authenticate as a privileged user on sites with user registration and the remember me login functionality enabled...

Xxe

The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions...

Security Bulletin: Session management vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1152)

Summary IBM Sterling Global Integration On-Demand Environment does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. Vulnerability Details CVEID: CVE-2017-1152 DESCRIPTION: IBM Sterling Global Integration On-Deman...

Insecure Session Management

github.com/hashicorp/vault does not properly handle and manage sessions. The vulnerability exists in Vault Enterprise, where the revocation of a token scoped to a non-root namespace does not properly trigger the revocation of the dynamic secret leases associated with the token...

Description of the security update for SharePoint Server 2019: November 12, 2019

None None...

The vulnerability of the Security component in the Symfony software development and web application management platform allows attackers to escalate their privileges.

The vulnerability of the Security component in the Symfony software development and web application management framework is related to session management errors. Exploiting this vulnerability can allow an attacker to gain increased privileges remotely...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private Core Services (CVE-2019-2386)

Summary A Security Vulnerability affects IBM Cloud Private Core Services Vulnerability Details CVEID: CVE-2019-2386 DESCRIPTION: MongoDB Server could allow a remote authenticated attacker to bypass security restrictions, caused by improper session management. By reusing an established session of...

CVE-2019-2271

CVE-2019-2271 is a buffer over-read in Qualcomm closed-source components used across Snapdragon lineups (e.g., APQ8009/8017/8053/8096A U, SDM/SM/SC families). It can occur when parsing downlink OTA messages with unintended network values, potentially enabling remote code execution or other impact...

Improper Session Management

modsessioncookie has improper session management as it does not respect expiry time...

Improper Session Management

nifi-web-api does not properly handle the authentication tokens. When using an authentication mechanism other than PKI, nifi-web-api does not invalidate the server-side authentication tokens when the user clicks log out. This results in the session being valid for another 12 hours despite logging...