Insufficient Session Expiration because of lacking of cache check

Description The web application's session management system suffers from an "Insufficient Session Expiration" vulnerability due to the lack of proper cache check. This vulnerability allows a user's session to remain valid even after the user has logged out, potentially granting unauthorized acces...

Citrix Cloud - Setting admin timeouts in Citrix Cloud portal

Requirement to know what the current timeout limit is when using Citrix Cloud and if it is possible to change the limit with regards to a Cloud Studio Admin session. Need to be able to force the user to have to login again after a certain amount of time...

Code injection

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the previous session on login...

CVE-2023-37065

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section...

CVE-2023-37065

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section...

CVE-2023-37065

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section...

CVE-2023-37065

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section...

Graylog user session is still usable after logout

Summary In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Details Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the...

The vulnerability of the Administrative XML Web Service (AXL) interface in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) systems allows a attacker to cause service failures.

The vulnerability of the Administrative XML Web Service AXL interface in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition systems is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious...

flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header

A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...

Cisco Unified Communications Manager 安全漏洞

Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable, and highly available enterprise IP telephony call processing solution. A security vulnerability exists...

Amazon Linux 2023 : python3-flask (ALAS2023-2023-183)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-183 advisory. Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy t...

CVE-2023-33684

Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 Apr 19 2021 Gui: 2.46 FPGA: 169.55 uc: 6.15 allows attackers on the same network to bypass authentication by re-using the IP address assigned to the device by the NAT protocol...

CVE-2023-33684

Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 Apr 19 2021 Gui: 2.46 FPGA: 169.55 uc: 6.15 allows attackers on the same network to bypass authentication by re-using the IP address assigned to the device by the NAT protocol...

CVE-2023-33684

Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 Apr 19 2021 Gui: 2.46 FPGA: 169.55 uc: 6.15 allows attackers on the same network to bypass authentication by re-using the IP address assigned to the device by the NAT protocol...

Authentication flaw

Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 Apr 19 2021 Gui: 2.46 FPGA: 169.55 uc: 6.15 allows attackers on the same network to bypass authentication by re-using the IP address assigned to the device by the NAT protocol...

CVE-2023-33684

Summary of CVE-2023-33684 (DB Elettronica Screen SFT DAB 600/C): The vulnerability stems from weak session management that lets an attacker on the same network bypass authentication by reusing the device’s NAT-assigned IP. Affected components/versions include Firmware 1.9.3, Bios 7.1 (Apr 19 2021...

PT-2023-24447 · Db Elettronica Telecomunicazioni Spa · Sft Dab 600/C Bios Firmware +4

Name of the Vulnerable Software and Affected Versions: DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware version 1.9.3 DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Bios firmware version 7.1 DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Gui version 2.46 DB Elettronica...

CVE-2023-33684

Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 Apr 19 2021 Gui: 2.46 FPGA: 169.55 uc: 6.15 allows attackers on the same network to bypass authentication by re-using the IP address assigned to the device by the NAT protocol...

Screen SFT DAB 600/C - Authentication Bypass Erase Account Exploit

!/usr/bin/env python3 Exploit Title: Screen SFT DAB 600/C - Authentication Bypass Erase Account Exploit Author: LiquidWorm Vendor: DB Elettronica Telecomunicazioni SpA Product web page: https://www.screen.it | https://www.dbbroadcast.com...