CVE-2019-5406

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media versions: prior to 3.5.0.1...

CVE-2019-5400

A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor versions: prior to 5.0.5.1...

CVE-2019-5406

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media versions: prior to 3.5.0.1...

CVE-2019-5406

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media versions: prior to 3.5.0.1...

CVE-2019-5406

CVE-2019-5406 concerns a remote session reuse vulnerability in HPE 3PAR StoreServ Management Console and related software (Management and Core Software Media) prior to version 3.5.0.1. Connected documents consistently describe it as a remote session reuse issue affecting HPE 3PAR StoreServ manage...

CVE-2019-5400

The CVE-2019-5400 entry describes a remote session reuse/authorization issue in HPE 3PAR Service Processor prior to version 5.0.5.1. Connected sources consistently identify the affected product as HPE 3PAR Service Processor and indicate the root cause is an authorization/session handling flaw tha...

CVE-2019-11541

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC Pulse Session option may see authentication leaks...

PT-2019-1544 · Red Hat +2 · Red Hat Openshift Container Platform +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.158 and earlier Jenkins LTS versions 2.150.1 and earlier Jenkins affected versions not specified in Redhat OpenShift Container Platform Description: The issue is related to an improper authorization vulnerability that allow...

Nginx < 1.6.2 SSL Session Reuse

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 0.5.6 or higher, 1.6.x prior to 1.6.2, or 1.7.x prior to 1.7.5. It is, therefore, affected by an SSL session or TLS session ticket key handling error. A flaw exists in the fi...

Nginx < 1.7.5 SSL Session Reuse

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 0.5.6 or higher, 1.6.x prior to 1.6.2, or 1.7.x prior to 1.7.5. It is, therefore, affected by an SSL session or TLS session ticket key handling error. A flaw exists in the fi...

CVE-2018-2442

In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid...

CVE-2018-2442

In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid...

CVE-2018-2442

Summary of CVE-2018-2442 : In SAP BusinessObjects BI (versions 4.0–4.2), viewing a Web Intelligence report from BI Launchpad can reveal session details captured by an HTTP analysis tool, which may be reused in an HTML page while the user session remains valid. This describes a cross‑site request ...

Apache Tomcat Patches Important Security Vulnerabilities

The Apache Software Foundation ASF has released security updates to address several vulnerabilities in its Tomcat application server, one of which could allow a remote attacker to obtain sensitive information. Apache Tomcat is an open source web server and servlet system, which uses several Java ...

Apache Tomcat Information Disclosure Vulnerability (CNVD-2018-13746)

Apache Tomcat is the United States Apache Apache Software Foundation under the Jakarta project of a lightweight Web application server, which is mainly used for the development and debugging of JSP programs for small and medium-sized systems. An information disclosure vulnerability exists in Apac...

The vulnerability of the Hawtio web console in the Apache ActiveMQ software platform allows a malicious actor to reuse the session identifier of an authenticated user.

The vulnerability of the Hawtio web console in the Apache ActiveMQ software platform stems from the lack of setting the HTTPOnly or Secure attributes for cookie files. Exploiting this vulnerability allows a malicious actor to repeatedly use the authenticated user’s session identifier remotely...

CVE-2017-14007

An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's session is available for an extended period beyond the last activity, allowing an attacker to reuse an old session for authorization...

ProMinent MultiFLEX M10a Controller Session Stealing Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. A session stealing vulnerability exists in ProMinent MultiFLEX M10a Controller, where a user's session can be used for a period of time longer than the last activity, which can be exploited by an attacker to reuse an old session for...

MGASA-2017-0325 Updated rt/perl-Encode packages fix security vulnerability

RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket CVE-2012-4733. RT 3.8.0 and above include a version of bin/rt th...

OracleVM 3.3 / 3.4 : curl (OVMSA-2017-0059)

The remote OracleVM system is missing necessary patches to address critical security updates : - treat Negotiate authentication as connection-oriented CVE-2017-2628 - fix a bug in DNS caching code that causes a memory leak 1302893 - SSH: make CURLOPTSSHPUBLICKEYFILE treat '' as NULL 1260742 - use...