PT-2021-17030

Name of the Vulnerable Software and Affected Versions Livy version 0.7.0-incubating Description The issue is a cross-site scripting flaw in the session name, allowing a malicious user to access logs and results of other users' sessions and run jobs with their privileges. Recommendations For Livy...

UBUNTU-CVE-2021-26118

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error...

CVE-2020-24594

Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session...

CVE-2020-24692

The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session...

PT-2020-15808

Name of the Vulnerable Software and Affected Versions Mitel MiContact Center Business versions prior to 9.3.0.0 Description The issue is related to insufficient input validation in the Ignite portal, which could allow an attacker to execute arbitrary scripts. A successful exploit could grant an...

PT-2020-15757

Name of the Vulnerable Software and Affected Versions Mitel MiCloud Management Portal versions prior to 6.1 SP5 Description The issue is related to insufficient input validation, which could allow an unauthenticated attacker to execute arbitrary scripts. A successful exploit could allow an attack...

CVE-2020-24594: Improper Neutralization of Input During Web Page Generation

Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session...

CVE-2020-24692: Improper Input Validation

The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session...

FreeIPA Session Access

The vulnerability of the FreeIPA server is related to the incorrect duration of the session. Exploiting this vulnerability can allow a hacker to gain access to the session...

rConfig Authorization Issues Vulnerability

rConfig is an open source network configuration management utility . An authorization issue vulnerability exists in rConfig version 3.9.4. An attacker could exploit this vulnerability to access other user sessions...

Mail.ru: User session access due to Oauth whitelist host bypass and postMessage

A destination for postMessage was not properly restricted on connect.mail.ru allowing crossite access to session, as was shown for 3k.mail.ru application session. Both connect.mail.ru and 3k.mail.ru belong to Ext.B scope, this scope does not offer a bounty for attacks with clientside vectors on t...

CVE-2020-5222

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials...

CVE-2019-9510

A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user sessions without needing to interact with the Windows lock screen. Should a network anomaly trigger a temporary RDP disconnect, Automatic...

Magento Insecure Authentication and Session Management Vulnerability

Magento is an open source PHP e-commerce system from the U.S. company Magento. An insecure authentication and session management vulnerability exists in Magento. An attacker can exploit this vulnerability to gain access to the customer account index page via the guest session ID value after a...

CVE-2017-12159

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks...

CVE-2019-14826

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session...

CVE-2019-3790

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was...

CVE-2019-1573

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN...

BigProf AppGini Information Disclosure Vulnerability

BigProf AppGini is a suite of platforms for creating responsive data management applications from BigProf Software, Egypt. A security vulnerability exists in BigProf AppGini version 5.70 that stems from the program's use of MD5 hashing to store passwords in the database. An attacker could exploit...

Microsoft Internet Explorer Multiple Vulnerabilities (KB4457426)

This host is missing a critical security update according to Microsoft security updates KB4457426. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...