dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method

A flaw was found in the SignInManager.RefreshSignInAsync method. This flaw allows an attacker with local access and low privileges to escalate privileges. The issue might lead to unauthorized access or manipulation of authentication sessions...

dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method

A flaw was found in the SignInManager.RefreshSignInAsync method. This flaw allows an attacker with local access and low privileges to escalate privileges. The issue might lead to unauthorized access or manipulation of authentication sessions...

dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method

A flaw was found in the SignInManager.RefreshSignInAsync method. This flaw allows an attacker with local access and low privileges to escalate privileges. The issue might lead to unauthorized access or manipulation of authentication sessions...

dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method

A flaw was found in the SignInManager.RefreshSignInAsync method. This flaw allows an attacker with local access and low privileges to escalate privileges. The issue might lead to unauthorized access or manipulation of authentication sessions...

dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method

A flaw was found in the SignInManager.RefreshSignInAsync method. This flaw allows an attacker with local access and low privileges to escalate privileges. The issue might lead to unauthorized access or manipulation of authentication sessions...

CVE-2025-24387

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue...

CVE-2025-24387 Missing CSRF protection

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue...

qcp has possible crash/DOS in some build configurations

Nature of issue: Crash Denial of Service Source of issue: Dependent package ring Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affected All versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks. Released qcp...

GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server

Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server...

Citrix - CSP Monthly Consumption licenses EOL

On 01-Mar-2025, Citrix Service Providers running License Server v11.17.2 build 51000 with a combination of certain types of licenses were unable to launch end user sessions. The impacted licenses were associated with a discontinued licensing offering. There were some cases where partners on the n...

The vulnerability of the WP Sessions Time Monitoring full-automatic content management system plugin allows attackers to execute arbitrary SQL queries.

The vulnerability of the WP Sessions Time Monitoring full-automatic content management system for WordPress exists due to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2025-1412

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

CVE-2025-1412

CVE-2025-1412 affects Mattermost Server 9.11.x (up to 9.11.6) and 10.4.x (up to 10.4.1). The issue: when converting a user to a bot, active sessions are not invalidated, enabling the converted user to escalate privileges depending on the bot’s granted permissions. Documented impact: potential pri...

CVE-2025-0423

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their...

WombatDialer 安全漏洞

WombatDialer is a powerful predictive dialer for Asterisk PBX from WombatDialer. A security vulnerability exists in WombatDialer versions prior to 25.02 that stems from mishandling of cookie sessions, leading to session identity disclosure...

PT-2025-6785 · Unknown · Bestinformed Web

Name of the Vulnerable Software and Affected Versions: BestInformed Web affected versions not specified Description: The issue arises from improper sanitization of user input in the BestInformed Web application, leading to multiple authenticated stored cross-site scripting vulnerabilities. An...

SUSE CVE-2024-1930

No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the opensession D-Bus method. For each...

CVE-2024-35049

SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590...

Siemens SIMATIC PCS neo, TIA Administrator, and TIA Portal

SUMMARY Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Siemens has released new versions for several...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2025-03533)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be use...