SimpleSAMLphp exposes credentials in session storage

Background In order to implement support for the SAML Enhanced Client or Proxy profile, the credentials obtained for authentication were stored in the state in order to pass them to the relevant routines. This, however, led to the credentials being recorded in the user’s session, which can be...

Encoded session passwords on session storage for Virtual Fabric platforms.(CVE-2024-29953)

A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. This could allow an authenticated user to view other users' session encoded passwords...

MAL-2024-1196 Malicious code in shopify-app-session-storage-prisma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0afb06ef56cbaa2e3b7c09055beebdadea0360bb5c31b6745f6dee330ddab1d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shopify-app-session-storage-drizzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85a95ee44e756deede8f29d57f2f661bfad35e584127979455d61c95920d1c26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1195 Malicious code in shopify-app-session-storage-drizzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85a95ee44e756deede8f29d57f2f661bfad35e584127979455d61c95920d1c26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-43317

An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component...

CVE-2023-43317

An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component...

Design/Logic Flaw

An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component...

CVE-2023-43317: Improper Privilege Management

An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component...

CVE-2023-43317

CVE-2023-43317 affects Coign CRM Portal v6.06. A vulnerability in the Session Storage component allows a remote attacker to escalate privileges via the userPermissionsList parameter, potentially granting admin-level access. Documented impact includes unauthorized data access and feature access. T...

CVE-2023-43317

An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component...

Coign CRM Portal Security Vulnerability

Coign CRM Portal is a customer relationship management system from Coign, Inc. A security vulnerability exists in Coign CRM Portal version v.06.06 that originates from allowing remote attackers to escalate privileges via the userPermissionsList parameter in the Session Storage component...

CVE-2023-43317

An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component...

Exploit for Improper Privilege Management in Coign

CVE-2023-43317 A normal user can elevate their privileges vi...

PT-2024-13080 · Unknown · Coign Crm Portal

Name of the Vulnerable Software and Affected Versions: Coign CRM Portal version 06.06 Description: An issue in the software allows a remote attacker to escalate privileges via the userPermissionsList parameter in the Session Storage component. Recommendations: For Coign CRM Portal version 06.06,...

PT-2023-29233 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.3 Description: The issue allows attackers with access to a user's device to gain persistent account access due to missing verification of Session Tokens after password changes and/or elapsed inactivity...

Debian: Security Advisory (DLA-272-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2020-15105

Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...

Apache::Session::LDAP 信任管理问题漏洞

Apache::Session::LDAP is a tool for storing Apache sessions in LDAP. A security vulnerability exists in Apache::Session::LDAP versions prior to 0.5 that stems from not checking the validity of an X.509 certificate...

You can’t stop me. MS Teams session hijacking and bypass

How cleartext session tokens are stored in an unsecured directory that can be stolen and used to impersonate a Teams user. TL;DR Microsoft Teams stores unencrypted session tokens and cached conversations in users’ roaming AppData, which can be used by an attacker to gain access to the victim’s...