83 matches found
Default credentials
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both...
CVE-2022-23502
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both...
CVE-2022-23502
TYPO3 contains an Insufficient Session Expiration after Password Reset vulnerability (CVE-2022-23502). The issue affects TYPO3 core versions prior to 10.4.33, 11.5.20, and 12.1.1, where password-reset sessions for a user account were not revoked for both frontend and backend sessions. The vulnera...
CVE-2022-23502 TYPO3 contains Insufficient Session Expiration after Password Reset
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both...
PT-2022-28056 · Typo3 · Fe Change Pwd
Name of the Vulnerable Software and Affected Versions: fe change pwd extension versions 2.0.5 and earlier, 3.x versions prior to 3.0.3 Description: An issue was discovered in the fe change pwd extension for TYPO3, where the extension fails to revoke existing sessions for the current user when the...
CVE-2022-47406
An issue was discovered in the fechangepwd aka Change password for frontend users extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed...
TYPO3 代码问题漏洞
TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 fechangepwd that stems from the extension's inability to revoke an existing session for the current user when the password is changed...
TYPO3 10.0.0 < 10.4.33 / 11.0.0 < 11.5.20 / 12.0.0 < 12.1.1 (TYPO3-CORE-SA-2022-014)
The version of TYPO3 installed on the remote host is prior to 10.0.0 10.4.33 / 11.0.0 11.5.20 / 12.0.0 12.1.1. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2022-014 advisory. - When users reset their password using the corresponding password recovery...
PT-2022-16035 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 10.4.33 TYPO3 versions prior to 11.5.20 TYPO3 versions prior to 12.1.1 Description: The issue concerns the password recovery functionality in TYPO3, an open source PHP based web content management system. When users...
Mattermost Server allows users with a session ID to revoke another users' session
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session...
GHSA-H564-6GC2-FCC6 Mattermost Server allows users with a session ID to revoke another users' session
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session...
8x8 Bounty: jaas.8x8.vc: Removed users can still have READ/WRITE access to the workspace via different API endpoints
An improper access control vulnerability was discovered in jaas.8x8.vc, where removed users could still have READ/WRITE access to the workspace via different API endpoints, if they were logged in and saved their session cookies. The issue was resolved by fixing the session management...
PT-2020-13448 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A security issue was found in GitLab where it failed to revoke current user sessions when two-factor authentication was activated,...
UBUNTU-CVE-2020-13302
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password...
CVE-2020-13302
Removed by vendor...
CVE-2020-13299
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session...
CVE-2020-13299
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session...
PT-2020-13443 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered that allows a malicious user to access a user account with an old password under certain conditions,...
FreeBSD : Gitlab -- multiple vulnerabilities (1fb13175-ed52-11ea-8b93-001b217b3468)
Gitlab reports : Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...