SUSE CVE-2021-34428

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

CVE-2021-34428

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being...

Uzbey: All Active user sessions should be destroyed when user change his password!

Hello, There is an user sessions issue on your application that should be fixed. Proof of Concept ------------------------ Suppose, you have an account on uzbey Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromised what you'll...

C2FO: All Active user sessions should be destroyed when user change his password!

Hello, There is an user sessions issue on your application that should be fixed. Proof of Concept ------------------------ Suppose, you have an account on C2FO app.c2fo.com. Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromise...

IRCCloud: iOS application does not destroy session upon logout.

After a user logs out of the iOS application, the server should be destroying the user's session. However, this is not occurring in the iOS application. When the log out request is made, the following request and response is sent and received from the server: REQUEST: POST /apn-unregister HTTP/1....

two bytehoard 2.1 bugs

Application: Bytehoard Versions: 2.1 alpha to epsilon Release Date: 2007-11-26 Author: Ernesto Alvarez / Activesec SA Kudos to: Rodrigo Seguel / Activesec SA for suggesting the session destruction approach Contact info: ealvarez at activesec biz Developer response: None. No response to mail, foru...