Zabbix-CVE-2022-23131

Zabbix-CVE-2022-23131 Zabbix-SAML-Bypass: CVE-2022-23131 Description: Zabbix is vulnerable to Frontend Authentication Bypass Vulnerability with enabled SAML SSO authentication, due to insecure client-side session storage. On successful exploit of this issue, it allows a malicious actor to escalat...

CVE-2022-23131

CVE-2022-23131 CVE-2022-23131Unsafe Session Storage 0x00 Preface Zabbix vulnerability CVE-2022-23131, I accidentally obtained a Zabbix server of a foreign company. Zabbix Sia Zabbix is an open-source monitoring system developed by Zabbix SIA Zabbix Sia from Latvia. This system supports network...

CVE-2024-48217

CVE-2024-48217 Sismart Vulnerability CVE Assigned: CVE-2024-48217 mitre.org nvd.nist.org tenable.com Date: 5 September 2024 Author: Ajriel Rizqy Maulana Software Link: SiSMART Aplikasi Pintar Penunjang Proses Pendidikan - 7.4.0 SiSMART Aplikasi Pintar Penunjang Proses Pendidikan API Version: 7.4....

CVE-2023-43317

CVE-2023-43317 A normal user can elevate their privileges via the userPermissionsLIst parameter in Session Storage component. to gain unauthorized access to administrative-level resources and features. This could lead to unauthorized data access, data modification, and other actions that are...

cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. replace zbxsignedsession to cookie 2. sign in with Single Sign-On SAML author: @random-robbie、@jweny and @Mr-xn link: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

Zabbix - SAML SSO Authentication Bypass

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. id: CVE-2022-23131 info: name: Zabbix - SAML SSO Authentication Bypass author: For3stCo1d,spac3wh1te severity: critical description:...

React-Router-CVE-2025-61686-

CVE-2025-61686 Vulnerability Analysis Report Vulnerability Overview CVE ID : CVE-2025-61686 Affected Versions : @react-router/node 7.0.0 to 7.9.3 Vulnerability Type : Path Traversal / Directory Traversal Vulnerability Principle 1. Vulnerability Location The vulnerability exists in the getFile...

zabbix-cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. replace zbxsignedsession to cookie 2. sign in with Single Sign-On SAML author: @random-robbie、@jweny and @Mr-xn link: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

Linux Distros Unpatched Vulnerability : CVE-2026-45048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce...

CVE-2026-45048

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session...

CVE-2026-45048 OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session...

CVE-2026-45048: Exposure of Sensitive Information to an Unauthorized Actor

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session...

CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-52873

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the...

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Summary Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user admin, provider, or secretary rebinds...

GHSA-8HM4-R66F-29WR Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Summary Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user admin, provider, or secretary rebinds...

Open Redirect

Snipe-IT is vulnerable to Open Redirect. The vulnerability is due to improper trust of the attacker-controlled Referer header, where the previous URL is stored in the session and later used for redirection without validation, allowing attackers to redirect users to malicious websites after a...

CVE-2026-52841

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns...

OpenStack Horizon has Incorrect Behavior Order

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

PYSEC-2026-2520 OpenStack Horizon has Incorrect Behavior Order

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...