MAL-2024-3850 Malicious code in w_session_legacy_membership_preferences (npm)

--- -= Per source details. Do not edit below this line.=-...

VulnNodeApp - A Vulnerable Node.Js Application

A vulnerable application made using node.js, express server and ejs template engine. This application is meant for educational purposes only. Setup Clone this repository git clone https://github.com/4auvar/VulnNodeApp.git Application setup: Install the latest node.js version with npm. Open...

Insecure Authentication And Session Management

magento/community-edition is vulnerable to Insecure Authentication and session management. The vulnerability is due to inadequate session validation, allows authenticated users to manipulate session parameters related to authentication and session management on the storefront, leading to security...

Toshiba e-STUDIO2518A Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Toshiba e-STUDIO2518A printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue results from improper...

The vulnerability of the QNAP TS-X41 network storage device, related to improper session management, allows a hacker to intercept the user’s session.

The vulnerability of the QNAP TS-X41 network storage device is related to improper session management. Exploiting this vulnerability could allow a malicious actor to intercept a user’s session...

UBUNTU-CVE-2024-36856

RMQTT Broker 0.4.0 is vulnerable to Denial of Service DoS due to improper session resource management. An attacker can exhaust system memory and crash the daemon by establishing and maintaining a vast number of long-lived malicious publish/subscribe sessions...

The vulnerability of the cross-platform access control system IBM i Access Client Solutions, related to improper session management, allows a hacker to intercept the user’s session and disclose sensitive information about the NT LAN Manager hash (NTLM).

The vulnerability of the cross-platform access control system IBM i Access Client Solutions is related to improper session management. Exploiting this vulnerability can allow an attacker to intercept a user’s session and disclose sensitive information about the NT LAN Manager hash NTLM...

CVE-2024-5185

The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF vulnerability due to the absence of a secure...

CVE-2024-5185

CVE-2024-5185 concerns the EmbedAI application, where a CSRF weakness resulting from the absence of secure session management and weak CORS policies enables data poisoning. An attacker can lure a user to a malicious page that triggers the CSRF flaw, causing the user to upload and integrate incorr...

CVE-2024-5185 Data Poisoning in EmbedAI

The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF vulnerability due to the absence of a secure...

PrivateGPT 安全漏洞

PrivateGPT is an AI project. PrivateGPT has a security vulnerability that stems from a lack of secure session management implementation and a weak CORS policy, resulting in a cross-site request forgery CSRF vulnerability. An attacker could use this vulnerability to trigger a data poisoning attack...

Session Hijacking

friendsofsymfony/user-bundle is vulnerable to session hijacking. The vulnerability is due to inadequate session management, which could allow an attacker to take over a users session...

Improper Session Management

reportico-web/reportico is vulnerable to Improper Session Management. The vulnerability is due to improper handling of session tokens, which allows an attacker to reuse a token after a user has logged out...

PT-2024-26297 · Unknown · Surveyking

Name of the Vulnerable Software and Affected Versions: SurveyKing version 1.3.1 Description: The issue allows users' sessions to remain active after logout, which is related to an incomplete fix. Recommendations: For SurveyKing version 1.3.1, consider implementing a full logout mechanism to...

IBM Cognos Controller Access Control Error Vulnerability

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. An access control error vulnerability exists in IBM...

CVE-2024-34092

An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 6.14.0.3 is also a fixed release...

kernel: tee: amdtee: fix race condition in amdtee_open_session

A use-after-free vulnerability was found in the AMD TEE driver in the Linux kernel. The flaw occurs from a race condition in the amdteeopensession function, where the session is marked as active in sess-sessmask before the corresponding sess structure is fully initialized. If a parallel thread...

CVE-2024-26331

ReCrystallize Server 5.10.0.0 is vulnerable to authentication bypass via cookie manipulation. The Nuclei template and Red Hat/NVD entries describe an issue where the cookie value (e.g., AdminUsername) is not bound to a session ID, allowing an attacker to bypass authentication by modifying the coo...

D-Link Multiple DAP Devices XSS Vulnerability (Apr 2024)

Multiple D-Link DAP devices are prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Session Hijacking

dolibarr/dolibarr is vulnerable to Session Hijacking. The vulnerability is due to inadequate user session management, allowing authenticated attackers to hijack victim users' session cookies and gain access to the CSRF protection tokens through interaction with a malicious web page, consequently...