66463 matches found
IBM Langflow OSS authorization issue vulnerability
The IBM Langflow OSS versions from 1.0.0 to 1.12.4 have an authorization issue vulnerability. This vulnerability stems from three message endpoints that fail to perform ownership verification. Any authenticated user can delete messages of other users in bulk, inject malicious prompts by overwriti...
IBM i Authorization Issues Vulnerabilities
Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have authorization-related vulnerabilities. These vulnerabilities stem from improper access control. Unauthenticated remote attackers can send specially crafted HTTP requests to any URL within the Navigator application before authentication is completed...
Cachet cross-site scripting vulnerabilities
Cachet 2.4.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from the event creation form, which contains stored cross-site scripts. Authorized attackers can inject malicious HTML/JavaScript, which can be executed in the browser of users viewing the status...
Apostrophe Technologies ApostropheCMS information leakage vulnerability
Apostrophe Technologies' ApostropheCMS has a vulnerability related to information leakage. This vulnerability arises from the practice of placing the one-time session token in the redirect URL during cross-host or cross-region session migrations. This allows attackers to obtain and exchange token...
IBM Cyber Fraud Exception Handling Vulnerability
IBM Cyber Fraud 1.0.0 to 1.0.2 versions have a vulnerability related to improper exception handling. This vulnerability arises due to the absence of the Secure attribute, allowing sensitive cookies to be transmitted over unencrypted connections. This could enable attackers to intercept session da...
jcrodriguez-dis Virtual Programming Lab for Moodle Cross-Site Script Vulnerabilities
The jcrodriguez-dis Virtual Programming Lab for Moodle versions prior to 5.0.0 has a cross-site scripting vulnerability. This vulnerability stems from the unencoded filename1/filename2 parameters in the similarity/diff.php file. It may lead to reflective cross-site scripting attacks. Attackers ca...
Oracle Applications Platform Engineering security vulnerabilities
A security vulnerability exists in Oracle Applications Platform Engineering versions 12.2.3 through 12.2.15. This vulnerability stems from issues within the Valid Session component and may allow low-privilege attackers to log in, gain control of the infrastructure, and take over Applications...
OAuth State Validation Bypass
github.com/0xjacky/nginx-ui is vulnerable to OAuth state validation bypass. The vulnerability is due to the use of a constant OAuth state value and the failure to validate the callback state against the initiating browser session, which allows an unauthenticated attacker to trick a victim’s brows...
Improper Authentication Enforcement
github.com/0xjacky/nginx-ui is vulnerable to improper authentication enforcement. The vulnerability is due to the failure to enforce secure session verification on multiple authenticated mutation routes, which allows an attacker with a stolen authenticated session to modify sensitive configuratio...
Security Bulletin: Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console
Summary Session Token exposure in Admin console in versions below 5.0.9 Vulnerability Details CVEID:CVE-2026-93892 DESCRIPTION: IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the...
CVE-2026-79624
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...
CVE-2026-79624 Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...
CVE-2026-79624
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...
EUVD-2026-104162
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...
CVE-2026-79624
The software Apache Answer is vulnerable to an insufficient session expiration issue in versions through 2.0.2 . Due to insufficient session invalidation, revoked users can maintain access to known private uploaded files by using a stale visit token . To remediate this vulnerability, users are re...
UBUNTU-CVE-2026-98707
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...
CVE-2026-12254: Insufficient Session Expiration
Netskope is notified about a potential gap in its agent NSClient where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via t...
PT-2026-117487
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Session-bound tokens are not revoked upon user session termination when token binding validation is enabled and the "Revoke token upon user logout" option is...
PT-2026-117690
Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 Description The system fails to invalidate the session after a user logs out. This flaw allows an authenticated user to impersonate another user on the system. Recommendations Update...