CVE-2022-2306

CVE-2022-2306 affects heroiclabs/nakama: old session tokens can be used to authenticate to the application, indicating insecure session expiration where logout does not invalidate tokens. The root cause described across connected sources is improper session handling allowing reuse of previously i...

CVE-2022-2306 Insufficient Session Expiration in heroiclabs/nakama

Old session tokens can be used to authenticate to the application and send authenticated requests...

CVE-2022-2306: Insufficient Session Expiration

Old session tokens can be used to authenticate to the application and send authenticated requests...

PT-2022-15820

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue allows old session tokens to be used for authentication to the application, enabling the sending of authenticated requests. Recommendations At the moment, there is no...

HCL Technologies Traveler Companion 跨站脚本漏洞

HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, India. It is used to read encrypted Hcl Notes emails on Apple devices.A cross-site scripting vulnerability exists in HCL Technologies Traveler Companion version 12.0.1.0 and earlier, which stems from...

Session tokens are not invalidated on logout

Description The session cookie is not invalidated on logout so, it can be used after logout as well. Proof of Concept Login to the Nakama console. Intercept the request. Below is a sample request: http GET /v2/console/user HTTP/1.1 Host: localhost:7351 Accept: application/json, text/plain, /...

CVE-2022-0734

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that coul...

CVE-2022-0734

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that coul...

CVE-2022-0734: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that coul...

CVE-2021-32958

Successful exploitation of this vulnerability on Claroty Secure Remote Access SRA Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface UI. With acces...

CVE-2021-32958 Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel

Successful exploitation of this vulnerability on Claroty Secure Remote Access SRA Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface UI. With acces...

PT-2022-10161

Name of the Vulnerable Software and Affected Versions Claroty Secure Remote Access SRA Site versions 3.0 through 3.2 Description Successful exploitation of this issue allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid...

CVE-2022-27888

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information session tokens. This issue was fixed in 2.249.1...

CVE-2022-27888

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information session tokens. This issue was fixed in 2.249.1...

Design/Logic Flaw

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information session tokens. This issue was fixed in 2.249.1...

CVE-2022-27888

Summary: CVE-2022-27888 affects Palantir Foundry Issues service versions 2.244.0–2.249.0, where logging could capture sensitive information (session tokens). It was fixed in 2.249.1. Impact: Exposure of session tokens through insecure logging (per the CVE description and citations). Affected prod...

CVE-2022-27888 The Foundry Issues service was found to be logging in a manner that captured session tokens.

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information session tokens. This issue was fixed in 2.249.1...

PT-2022-18669

Name of the Vulnerable Software and Affected Versions Foundry Issues service versions 2.244.0 through 2.249.0 Description The issue concerns the logging mechanism in the Foundry Issues service, which captured sensitive information, specifically session tokens. This problem was resolved in version...

CVE-2022-27888: Insertion of Sensitive Information into Log File

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information session tokens. This issue was fixed in 2.249.1...

Johnson Controls Metasys ADS/ADX/OAS Servers 安全漏洞

Johnson Controls Metasys ADS/ADX/OAS Servers are an application and data server from Johnson Controls, Inc. A security vulnerability exists in Johnson Controls Metasys ADS/ADX/OAS Servers that stems from the fact that under certain circumstances, session tokens are not cleared upon logout...