CVE-2021-38823

IceHrm 30.0.0 OS website has a Session Management vulnerability where signing out from an admin account does not invalidate an admin session opened in another browser. Root cause/details beyond this description are not provided in the connected documents. Impact is indicated as severe by CVSS sco...

CVE-2021-38823

The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different browser...

CVE-2021-37333

CVE-2021-37333 affects the Laravel Booking System Booking Core 2.0. The vulnerability is a Session Management issue where changing a password via sandbox.bookingcore.org/user/profile/change-password does not invalidate an active session in another browser, allowing continued access after a passwo...

CVE-2021-37333

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...

Gitlab -- vulnerabilities

Gitlab reports: Stored XSS in merge request creation page Denial-of-service attack in Markdown parser Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown DNS Rebinding vulnerability in Gitea importer Exposure of trigger tokens on project exports Improper access control for...

APACHE SHIRO authentication bypass vulnerability

Apache Shiro is a powerful and easy-to-use Java security framework with features including authentication, authorization, encryption and session management.APACHE SHIRO authentication bypass vulnerability can be exploited by attackers to construct specific HTTP requests to bypass authentication a...

Exploit for Session Fixation in Gogs

CVE-2018-18925 Exploitation of CVE-2018-18925 a Remote Code Ex...

A2: Broken Authentication ❗️ — Top 10 OWASP 2017

A2: Broken Authentication ❗️ — Top 10 OWASP 2017 Introduction When issues arise within the authentication of a program, there are most likely a wide range of dire implications. An example we can discuss is when there is a weak password policy which allows for easily guessable or brute forceable...

Courier: Possible to invite any team member without being logged in. [ Session Management Issue ]

Hi, I would like to report session management issue to you, while testing i found that we can easily invite or we can easily perform invite related action, even we logged out from the the account. This mean the session are not properly managed. I didn't checked the other functionality under sessi...

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns stems from session management errors, which allow attackers to compromise data integrity.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to session management errors. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...

PT-2021-6547 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 13.12.9 GitLab CE/EE versions prior to 14.0.7 GitLab CE/EE versions prior to 14.1.2 Description: The issue is related to incorrect session management in GitLab, allowing a remote attacker to impact data integrit...

Phabricator: Broken Authentication and Session Management lead to take over account

Hello, I found vulnerability using phone Summary : Session token weakness, allowing attackers to take over accounts Tools : Lightning.apk Browser SandroProxy.apk or you can use all available proxies Steps to Reproduce: 1 Create a phacility account. 2 Go to...

CVE-2021-26095

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its...

CVE-2021-26095

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its...

Design/Logic Flaw

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its...

CVE-2021-26095

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its...

CVE-2021-26095

FortiMail is affected by cryptographic issues in the session management cookie for FortiMail 6.2.0–6.2.6 and 6.4.0–6.4.4. The vulnerability allows a remote attacker who already holds a valid cookie to reveal, alter, or forge its content, potentially escalating privileges. Remediation per Fortinet...

CVE-2021-26095

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its...

CVE-2021-26037

CVE-2021-26037 affects Joomla! core versions 2.5.0 through 3.9.27. The root cause is that CMS functions did not properly terminate existing user sessions when a user’s password was changed or the user was blocked. This behavioral gap can allow an attacker to retain or regain a session that should...

FortiMail - Improper cryptographic operations in cookie encryption potentially prone to forgery

The combination of various cryptographic issues in the session management of FortiMail, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges...