Login Alert - Moderately critical - Access bypass - SA-CONTRIB-2019-013

This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account. The module...

Session fixation

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658...

Security Bulletin: IBM Security Identity Manager is affected by multiple vulnerabilities (CVE-2018-1959, CVE-2018-1962, CVE-2018-1970)

Summary IBM Security Identity Manager VA ISIM VA has addressed the following vulnerabilities due to hard-coded credentials, the lack of proper session termination, and XML external entity injection. Vulnerability Details CVEID: CVE-2018-1959 DESCRIPTION: IBM Security Identity Manager Virtual...

Progress Sitefinity Information Disclosure Vulnerability

Progress Sitefinity is an open source platform for building corporate websites and intranets. A security vulnerability exists in Progress Sitefinity version 9.1, which stems from the fact that the wrapaccesstoken remains valid and is passed via a GET parameter after a session termination or...

CVE-2017-18179

Progress Sitefinity 9.1 uses wrapaccesstoken as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1...

CVE-2016-8638

Ipsilon is affected by a SAML2 multi-session vulnerability (CVE-2016-8638). Affected versions: ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3. The issue relates to how sessions are tracked, allowing an unauthenticated attacker to view and terminate active sessi...

CVE-2016-6332

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked...

Error session termination mechanisms lead to account hijacking-vulnerability warning-the black bar safety net

Error session termination mechanisms Session termination is to secure the session period in one important aspect. Security implementation session tokens can effectively reduce the session hijacking attack. The session is terminated as the number of attack control mechanisms, such asXSS（cross-site...

ipsilon: DoS via logging out all open SAML2 sessions

A vulnerability was found in ipsilon in the SAML2 provider's handling of sessions. An attacker able to hit the logout URL could determine what service providers other users are logged in to and terminate their sessions...

Moodle 2.1.x < 2.1.9 / 2.2.x < 2.2.6 / 2.3.x < 2.3.3 Multiple Vulnerabilities

Binary data 9528.prm...

Vulnerability of Firefox and Firefox ESR browsers, allowing attackers to execute arbitrary code

The vulnerability of WebRTC sockets in Firefox and Firefox ESR browsers relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by using incorrect free operations on DTLS objects during the termination of a WebRTC session...

The vulnerability of the PostgreSQL database management system allows a hacker to trigger a service failure.

The vulnerability of the PostgreSQL database management system is related to a memory reclamation error. Exploiting this vulnerability allows an attacker, operating remotely, to cause a service failure by terminating the SSL session at a certain time...

The vulnerability of the ZyXEL PMG5318-B20A router allows a violator to circumvent existing access restrictions.

The vulnerability of the ZyXEL PMG5318-B20A router exists due to the absence of session termination after exiting the system. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using an automated workstation...

CVE-2015-6019

The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation...

CVE-2015-6019

The CVE-2015-6019 issue affects ZyXEL PMG5318-B20A devices running firmware 1.00AANC0b5, where the management portal does not terminate sessions on logout. This allows an attacker to reuse an active session from an unattended workstation and bypass access restrictions. The connected CERT/NVD entr...

CVE-2015-6019

The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation...

The vulnerability of the NX-OS network operating system allows a hacker to induce a maintenance failure.

The vulnerability of the NX-OS network operating system is related to resource management errors. Exploiting this vulnerability could allow a malicious actor, operating locally, to cause service interruptions due to errors in the session termination process...

IBM Rational Requirements Composer and Rational DOORS Next Generation Local Elevation of Privilege Vulnerability

IBM Rational Requirements Composer and Rational DOORS Next Generation RDNG are requirements management solutions from IBM USA. When WebSphere Application Server and LTPA single sign-on used in IBM Rational Requirements Composer and RDNG are used together, the program fails to terminate the...

CVE-2015-0121

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

CVE-2015-0993

Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation...