4265 matches found
BIT-NODE-2020-8201
Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...
BIT-REDMINE-2021-37156
Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...
BIT-PARSE-2020-15270 Improper session expiration in Parse Server
Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...
BIT-MAGENTO-2021-21032 Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
Magento versions 2.4.1 and earlier, 2.4.0 and earlier and 2.3.6 and earlier do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation...
Cisco Duo 安全漏洞
Cisco Duo is a fully managed solution from Cisco, Inc. Provides secure access to your applications and data. An authentication bypass vulnerability exists in Cisco Duo that stems from the inability to disable locally created trusted sessions after an affected device reboots, which can be exploite...
PT-2024-22134 · Symfony +2 · Symfony +2
Name of the Vulnerable Software and Affected Versions: Shopware versions 6.5.8.0 through 6.5.8.6 Description: The issue arises from the Symfony Session Handler popping the Session Cookie and assigning it to the Response. Since Shopware 6.5.8.0, 404 pages are cached to improve performance, resulti...
CVE-2024-21722
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...
CVE-2024-21722
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...
Information disclosure
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...
CentOS 9 : xorg-x11-server-Xwayland-21.1.3-5.el9
The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the xorg-x11-server-Xwayland-21.1.3-5.el9 build changelog. - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in...
CentOS 9 : tigervnc-1.12.0-9.el9
The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the tigervnc-1.12.0-9.el9 build changelog. - A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory...
CVE-2024-26342
creationtimestamp| type| source ---|---|--- 2024-02-28 19:26:59+00:00| seen| https://t.me/ctinow/195775 2024-02-28 19:27:06+00:00| seen| https://t.me/ctinow/195781 2025-04-22 16:03:14+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12876...
CVE-2024-24705
creationtimestamp| type| source ---|---|--- 2024-02-28 16:46:39+00:00| seen| https://t.me/ctinow/195644 2024-02-28 16:46:43+00:00| seen| https://t.me/ctinow/195648 2024-03-15 01:07:08+00:00| seen| https://t.me/ctinow/208320...
PT-2024-1897 · Cisco · Cisco Nx-Os +1
Name of the Vulnerable Software and Affected Versions: Cisco NX-OS affected versions not specified Description: A vulnerability in the External Border Gateway Protocol eBGP implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS...
Rails has possible Sensitive Session Information Leak in Active Storage
Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxi...
[SECURITY] Fedora 38 Update: sofia-sip-1.13.12-2.fc38
Sofia SIP is a RFC-3261-compliant library for SIP user agents and other network elements. The Session Initiation Protocol SIP is an application-layer control signaling protocol for creating, modifying, and terminating sessions with one or more participants. These sessions include Internet telepho...
@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys
Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control. Solution Usin...
GHSA-84C3-J8R2-MCM8 @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys
Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control. Solution Usin...
PT-2024-40180 · Unknown · @Nfid/Embed Sdk +2
Name of the Vulnerable Software and Affected Versions: @nfid/embed SDK versions prior to 0.10.1-alpha.6 @dfinity/auth-client versions prior to 1.0.1 @dfinity/identity versions prior to 1.0.1 Description: The issue affects user sessions in the @nfid/embed SDK that utilize Ed25519 keys, due to a...