CVE-2025-22216

CVE-2025-22216 affects CloudFoundry UAA (multi-identity-zone configuration). The issue is improper validation of session information across zones, allowing a user authenticated against a corporate IDP to reuse a jsessionid to access other zones. Affected releases include UAA up to 77.20.1, 77.24....

rubygem-activestorage: Possible Sensitive Session Information Leak in Active Storage

A flaw was found in Active Storage that may lead to a sensitive session information leak. By default, Active Storage sends a Set-Cookie header along with the user’s session cookie when serving blobs and sets Cache-Control to public. Certain proxies may cache Set-Cookie, leading to an information...

CVE-2024-33610

"sessionlist.html" and "systrayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "systrayentryreboot.html" allows to reboot the device. As for the details of affected product names, model number...

CVE-2024-33610

"sessionlist.html" and "systrayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "systrayentryreboot.html" allows to reboot the device. As for the details of affected product names, model number...

CVE-2024-33610

"sessionlist.html" and "systrayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "systrayentryreboot.html" allows to reboot the device. As for the details of affected product names, model number...

CVE-2024-33610

CVE-2024-33610 affects Sharp Multifunction Printers. Pre-authentication exposure allows listing of session cookies via both sessionlist.html (no authentication) and related admin page artifacts, enabling potential session hijacking or unauthorized access. The Nuclei template notes a backdoor-like...

CVE-2024-23586 An insufficient session timeout vulnerability affects HCL Nomad server on Domino

HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old session information...

CVE-2024-20395

A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when the app accesses embedded media, such ...

CVE-2024-20395

Cisco Webex App contains a vulnerability in the media retrieval functionality that could allow an unauthenticated, adjacent attacker to access sensitive session information by intercepting insecurely transmitted requests for embedded media. The root cause is insecure transmission of requests to b...

CVE-2024-20395

A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when the app accesses embedded media, such ...

PT-2024-5197 · Cisco · Cisco Webex App

Name of the Vulnerable Software and Affected Versions: Cisco Webex App affected versions not specified Description: A vulnerability in the media retrieval functionality could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This issue is due to insecure...

GO-2024-2968 ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GHSA-CVW9-C57H-3397 ZITADEL Vulnerable to Session Information Leakage

Impact ZITADEL provides users the ability to list all user sessions of the current user agent browser by API and in the Console UI. Due to a missing check, user sessions without that information e.g. when created though the session service were incorrectly listed exposing potentially other user's...

CVE-2024-39683 ZITADEL Vulnerable to Session Information Leakage

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent browser. Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information e.g...

CVE-2024-39683

CVE-2024-39683 affects ZITADEL open-source identity infrastructure. A missing check allowed listing of user sessions across different users in the browser context, exposing potentially other users’ sessions. The issue occurs in versions starting from 2.53.0 and remains present in prior to fixed v...

CVE-2024-39683 ZITADEL Vulnerable to Session Information Leakage

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent browser. Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information e.g...

CVE-2024-29175

Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session...

CVE-2024-29175

CVE-2024-29175 concerns Dell PowerProtect Data Domain. The affected products are Dell PowerProtect Data Domain versions prior to 7.13.0.0, LTS 7.7.5.40, and LTS 7.10.1.30, where a weak cryptographic algorithm vulnerability could enable a remote, unauthenticated attacker to perform a man-in-the-mi...

CVE-2024-5996

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-5996

The CVE has a rejection note in the Initial Description, but connected data provides concrete details: Soar Cloud HR Portal is affected. The PT-Security entry PT-2024-37301 reports that notification emails from Soar Cloud HR Portal include links with embedded session data and are sent without enc...