CVE-2019-1807

The CVE-2019-1807 issue affects the Cisco Umbrella Dashboard web UI. It arises from session management: when a user authenticates and changes credentials in another active session, the app does not invalidate the existing session. An attacker with a separate, authenticated session could access th...

CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability

A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session...

Cisco Small Business RV320 and RV325 Routers Session Hijacking Vulnerability

A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. An attacker could use this impersonated...

Cisco Umbrella Dashboard Session Management Vulnerability

A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session...

Insecure Session Management

flarum/core contains an insecure session management. A lack of expiry and invalidation in the user email tokens allows a remote attacker to reuse the email tokens belonging to users to gain access to the application...

Insecure Session Management

contao/core-bundle contains an insecure session management. The old opt-in tokens are not invalidated when a new token is confirmed...

CVE-2019-5890

An issue was discovered in OverIT Geocall 6.3 before build 2:346977. Weak authentication and session management allows an authenticated user to obtain access to the Administrative control panel and execute administrative functions...

Authentication flaw

An issue was discovered in OverIT Geocall 6.3 before build 2:346977. Weak authentication and session management allows an authenticated user to obtain access to the Administrative control panel and execute administrative functions...

CVE-2019-5890

Affected software: OverIT Geocall 6.3 (before build 2:346977). Vulnerability: Weak authentication and session management allow an authenticated user to access the Administrative control panel and execute administrative functions. Root cause (as described): Improper session handling enabling eleva...

PT-2019-17848 · Overit · Overit Geocall

Name of the Vulnerable Software and Affected Versions: OverIT Geocall version 6.3 before build 2:346977 Description: An issue in OverIT Geocall allows an authenticated user to obtain access to the Administrative control panel and execute administrative functions due to weak authentication and...

Omise: Failure to Invalid Session after Password Change

While conducting my researching I discovered that the application Failure to invalidate session after password. In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords. Steps to Reproduce: ---------------------- Video PoC attached Step By...

Magento Community Edition 2.0.x < 2.0.16 Multiple Vulnerabilities

Binary data 700416.prm...

Buffer overflow

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

CVE-2018-0696

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

CVE-2018-0696

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

Apache 2.4.x < 2.4.33 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.33. It is, therefore, affected by multiple vulnerabilities: - An out of bounds write vulnerability exists in modauthnzldap with AuthLDAPCharsetConfig enabled. An unauthenticated, remote attacker can...

DRUPAL-CONTRIB-2019-013

This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account. The module...

Kentix MultiSensor-LAN 5.63.00 Authentication Bypass Vulnerability

Kentix MultiSensor-LAN versions 5.63.00 and below suffer from an authentication bypass vulnerability. The web based application is not using a usual session concept with a session cookie for managing authenticated user sessions. Some URLs are protected with HTTP Basic Authentication, but the user...

Oracle E-Business Multiple Vulnerabilities (Jan 2019 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2019 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the January 2019 Critical Patch Update advisory : - Oracle CRM Technical Foundation Messages component is...

Design/Logic Flaw

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Session Management. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...