Coursera: Broken authentication and session management flaw

In this Loop Hole The Application does not destroy session after logout.. means the cookies are working to login to user account & change account Information, The Cookies are usable after many hours of logout about after 1 day i'm able to access the account & edit info. Steps To Reproduce This...

Paragon Initiative Enterprises: Session Management Issue CMS Airship

Hey, I've found a session management issue in CMS Airship bridge.cspr.ng Issue ---------- When the password of an account is changed from a session, other sessions doesn't expire! Steps to Reproduce + We Need to use two broswers 1. Login to one browser 2. Login to second browser 3. Then change th...

WordPress Welcart e-Commerce Plugin <= 1.8.2 - Session Management

This plugin is prone to a session management vulnerability. Solution Update the plugin...

WordPress plugin "Welcart e-Commerce" vulnerable to session management

Overview WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a vulnerability in session management. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

Welcart e-Commerce < 1.8.3 - Session Management

The Welcart e-Commerce WordPress plugin was affected by a Session Management security vulnerability...

JVN#61578437: WordPress plugin "Welcart e-Commerce" vulnerable to session management

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a vulnerability in session management. Impact A remote attacker who knows a user's e-mail address may log in with the user privilege. As a result, arbitrary operations may be conducted. Solution Update the Software Update to t...

Nextcloud: help.nextcloud.com: Session Management Issue

Hey, I've found a session management in help.nextcloud.com, which can lead to session takeover! Issue: ======== When the password of an account is changed from a session, other sessions doesn't expire! Steps to Reproduce: -------------- + We need to use two different browsers. Login to both...

Paragon Initiative Enterprises: Session Management

When i click on forgot password i will get a reset link to my account when i login with the same email and password it will login to my account now if i open the reset link in another web browser and change the password and login to my account the session in the first browser is not expired i am...

FreeBSD : mediawiki -- multiple vulnerabilities (b50f53ce-2151-11e6-8dd3-002590263bf5)

MediaWiki reports : Security fixes : T122056: Old tokens are remaining valid within a new session T127114: Login throttle can be tricked using non-canonicalized usernames T123653: Cross-domain policy regexp is too narrow T123071: Incorrectly identifying http link in a's href attributes, due to m...

mediawiki -- multiple vulnerabilities

Mediawiki reports: Security fixes: T122056: Old tokens are remaining valid within a new session T127114: Login throttle can be tricked using non-canonicalized usernames T123653: Cross-domain policy regexp is too narrow T123071: Incorrectly identifying http link in a's href attributes, due to m...

appleple a-blog cms unauthorized operation vulnerability

appleple a-blog cms is a content management system CMS from appleple Japan. A security vulnerability exists in the session management of the comment feature in appleple a-blog cms 2.6.0.1 and earlier versions. A remote attacker can exploit this vulnerability to delete arbitrary comments or obtain...

New Relic: Improper Session Management

When a User successfully login to account there are new 3 links which he/she can visit but when a user Logout from one link ex:- HTTP://insights.newrelic.com/accounts/11 user successfully logout message will appear & logout. Here user will logout from 2 links ex :-...

a-blog cms vulnerable to session management

Overview a-blog cms provided by appleple Inc. is a content management system CMS. a-blog cms contains a vulnerability in session management of the comment functionality. Yuya Yoshida of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

JVN#03975805: a-blog cms vulnerable to session management

a-blog cms provided by appleple Inc. is a content management system CMS. a-blog cms contains a vulnerability in session management of the comment functionality. Impact An arbitrary comment posted may be deleted or a commenter's e-mail address may be obtained by an unauthenticated remote attacker...

Multiple Vulnerabilities in Netgear Router JNR1010

Netgear Router JNR1010 is a wireless router product. The Netgear Router JNR1010 is vulnerable to authentication bypass and improper session management. The developer frequently establishes authentication and session management schemes that are vulnerable in logout, password management, timeout, a...

CVE-2015-5170-5173 UAA Vulnerabilities | Cloud Foundry

CVE-2015-5170-5173 UAA Vulnerabilities Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions v215 & prior UAA versions 2.5.1 & prior Description CSRF Attack on PWS. It is possible to log the user into another account instead of the account they intended to log into because of...

CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

CVE-2015-2005

IBM QRadar SIEM is affected by CVE-2015-2005. Affected versions: QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6. The root cause is improper session expiry, enabling a local user to access information from a previous browser session. Remediation: apply IBM fixes 7.2.5 Pat...

Netgear 1.0.0.24 Bypass / Improper Session Management

Hi, Can you assign CVE id to this flaw? Details ================ Product Vendor: Netgear Netgear GPL: http://kb.netgear.com/app/answers/detail/aid/2649//netgear-open-source-code-for-programmers-gpl http://www.gnu.org/licenses/gpl.txt Bug Name: Broken Authentication & Improper Session Management i...

eWON XSS / CSRF / Session Management / RBAC Issues

eWON sa Industrial router - Multiple Vulnerabilities eWON connects the machine across the Internet Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all...