CVE-2019-2386

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9;...

CVE-2019-2386

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9;...

PT-2019-16408

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 4.0.9 MongoDB Server versions prior to 3.6.13 MongoDB Server versions prior to 3.4.22 Description The improper invalidation of authorization sessions in MongoDB Server allows an authenticated user's session to...

CVE-2019-2386: Improper Authorization

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9;...

ALPINE-CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

PT-2019-2050

Name of the Vulnerable Software and Affected Versions Cisco Umbrella Dashboard affected versions not specified Description A vulnerability in the session management functionality of the Cisco Umbrella Dashboard's web UI could allow an authenticated, remote attacker to access the Dashboard via an...

CVE-2019-6590

On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic...

DEBIAN-CVE-2019-7347

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

CVE-2019-7347: Time-of-check Time-of-use (TOCTOU) Race Condition

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

Jenkins < 2.150.2 LTS / 2.160 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.160 or is a version of Jenkins LTS prior to 2.150.2. It is, therefore, affected by multiple vulnerabilities: An improper authorization vulnerability exists in the Hudson CI tool as part of Jenkins Core due to inadequate...

CVE-2018-1999045: Improper Authentication

A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled...

Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is susceptible to multiple vulnerabilities. (CVE-2015-5345, CVE-2016-0706, CVE-2016-0714, CVE-2015-5174)

Summary Open Source Apache Tomcat is susceptible to multiple vulnerabilities. Vulnerability Details CVE-ID: CVE-2015-5345 Description: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an error when accessing a protected directory. By redirecting to the URL, a...

CVE-2018-2408

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active...

F5 Networks BIG-IP : Apache Tomcat 6.x vulnerabilities (K58084500)

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

CVE-2017-14163

An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without logging out of Mahara, the value in the usrsession table is not removed. If someone were to open a browser, visit the Mahara site, and adjus...

EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2016-1054)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103)

The following packages have been upgraded to a newer upstream version: tomcat 7.0.69. Security Fixes : - A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an...

tomcat security update

CentOS Errata and Security Advisory CESA-2016:2599 An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RHEL 6 / 7 : Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7 (Important) (RHSA-2016:2807)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2807 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. This release of Red Hat JBoss Web Serve...

tomcat: Security Manager bypass via persistence mechanisms

It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session...