PT-2019-1517

Name of the Vulnerable Software and Affected Versions IntelR Data Center Manager SDK versions prior to 5.0.2 Description The issue is related to insufficient session authentication in the web server, which may allow an unauthenticated user to potentially enable escalation of privilege via network...

Apache 2.4.x < 2.4.33 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.33. It is, therefore, affected by multiple vulnerabilities: - An out of bounds write vulnerability exists in modauthnzldap with AuthLDAPCharsetConfig enabled. An unauthenticated, remote attacker can...

DRUPAL-CONTRIB-2019-013

This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account. The module...

CVE-2019-1003004

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have...

Kentix MultiSensor-LAN 5.63.00 Authentication Bypass Vulnerability

Kentix MultiSensor-LAN versions 5.63.00 and below suffer from an authentication bypass vulnerability. The web based application is not using a usual session concept with a session cookie for managing authenticated user sessions. Some URLs are protected with HTTP Basic Authentication, but the user...

Oracle E-Business Multiple Vulnerabilities (Jan 2019 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2019 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the January 2019 Critical Patch Update advisory : - Oracle CRM Technical Foundation Messages component is...

Design/Logic Flaw

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Session Management. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-2488

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Session Management. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2019-28444)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. CRM Technical Foundation is one of the provision of Java-based infrastructure components for the development of e-business solutions. A security...

CVE-2019-2488: Undefined Security Weakness

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Session Management. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CloudBees Jenkins and LTS Authorization Issues Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor continuous software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins a long-ter...

Security Bulletin: IBM API Connect Developer Portal is affected by Insecure Session Management in Drupal

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: Not Applicable DESCRIPTION: Session Limit module for Drupal could allow a remote attacker to obtain sensitive information, caused by improper tokenize of the list of sessions. By inspecting the forms, ...

Apache Superset 0.23 Remote Code Execution

Exploit Title: Apache Superset 0.23 - Remote Code Execution Date: 2018-05-17 Exploit Author: David May [email protected] Vendor Homepage: https://superset.apache.org/ Software Link: https://github.com/apache/incubator-superset Version: Any before 0.23 Tested on: Ubuntu 18.04 CVE-ID:...

Liberapay: Broken Authentication and session management OWASP A2

Hello @liberapay, Description: It seems now if attacker has csrf token & victim cookies then attacker can easily login to victim account without any login details. No need Of Any Username/Password Theory Proof-Of-Concept: - Go to https://liberapay.com/admin.101/edit/username any username/Self...

The vulnerability affects the implementation of Security Assertion Markup Language, a mechanism for authentication in software-based secure mobile access solutions from Cisco. This vulnerability allows attackers to bypass the authentication process.

The vulnerability of the Security Assertion Markup Language SAML authentication mechanism for Single Sign-On SSO in Cisco AnyConnect Secure Mobility Client, Cisco Adaptive Security Appliance ASA, and Cisco Firepower Threat Defense FTD is related to improper session management. Exploiting this...

CVE-2018-0682

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors...

CVE-2018-0682

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors...

CVE-2018-0682

Denbun CVE-2018-0682 stems from improper session management in Denbun POP (v3.3P R4.0 and earlier) and Denbun IMAP (v3.3I R4.0 and earlier). This weakness lets remote attackers read or send mail and modify configuration via unspecified vectors. The CVSS (3.0) vectors indicate high impact across c...

CVE-2018-0682

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors...

CVE-2018-0682: Undefined Security Weakness

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors...