Security Bulletin: IBM Predictive Maintenance and Quality (PMQ) UI: Missing Secure Attribute in Encrypted Session (SSL) Cookie (CVE-2020-4423)

Summary PMQ UI web application sends non-secure cookies over SSL. It may be possible to steal user and session information cookies that was sent during an encrypted session. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...

The Hidden Risks of LLM-Generated Web Application Code: a Security-Centric Evaluation of Code Generation Capabilities in Large Language Models

The rapid advancement of Large Language Models LLMs has enhanced software development processes, minimizing the time and effort required for coding and enhancing developer productivity. However, despite their potential benefits, code generated by LLMs has been shown to generate insecure code in...

CVE-2025-28242

Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...

CVE-2025-28238

Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack...

CVE-2024-45651

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system...

CVE-2025-28242

Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...

CVE-2025-28238

Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack...

Denkovi DAEnetIP4 METO 安全漏洞

Denkovi DAEnetIP4 METO is a multifunctional 10/100 Mb Ethernet device IP controller from Denkovi for management and control. A security vulnerability exists in Denkovi DAEnetIP4 METO version 1.25, which stems from improper session management in the /loginok.htm endpoint, and could lead to a sessi...

PT-2025-17328

Name of the Vulnerable Software and Affected Versions DAEnetIP4 METO version 1.25 Description The issue is related to improper session management in the "/login ok.htm" endpoint, which allows attackers to execute a session hijacking attack. Recommendations For DAEnetIP4 METO version 1.25, conside...

CVE-2025-28238

Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack...

PT-2025-17327 · Elber · Elber Reble310

Name of the Vulnerable Software and Affected Versions: Elber REBLE310 Firmware version 5.5.1.R Description: The issue is related to improper session management, which allows attackers to execute a session hijacking attack. This can be exploited in the Elber REBLE310 equipment with the model numbe...

CVE-2025-28242

Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...

CVE-2025-28242

Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...

CVE-2025-28242

DAEnetIP4 METO v1.25 is affected by improper session management in the /login_ok.htm endpoint, enabling session hijacking. The issue, documented in multiple sources (CVE-2025-28242 and the DAEnetIP4 METO/Nuclei template), indicates attackers can hijack user sessions if they control or intercept s...

CVE-2025-28238

The CVE-2025-28238 entry concerns the Elber REBLE310 Firmware (v5.5.1.R) with improper session management that enables session hijacking. Affected component: firmware on Elber REBLE310 equipment (models REBLE310/RX10/4ASI). Root cause described as inadequate handling of session state allowing an ...

CVE-2025-28238

Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack...

CVE-2024-49825

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2025-22040

CVE-2025-22040 affects the Linux kernel ksmbd multichannel path. A race between session setup and ksmbd_sessions_deregister can free a session before its connection is added to the session’s channel list. The fix adds a reference-count check before freeing the session. Documented impact is high (...

CVE-2025-24859

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This...

Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence

A critical security vulnerability has been disclosed in the Apache Roller open-source, Java-based blogging server software that could allow malicious actors to retain unauthorized access even after a password change. The flaw, assigned the CVE identifier CVE-2025-24859 , carries a CVSS score of...