Samly security breach

Samly is used to enable the Plug/Phoenix application via SAML. A security vulnerability exists in Samly versions prior to 1.4.0, which stems from the ability to return expired sessions, which can interfere with access control...

CVE-2024-22313

creationtimestamp| type| source ---|---|--- 2024-02-10 17:26:23+00:00| seen| https://t.me/ctinow/182614 2024-03-03 13:46:58+00:00| seen| https://t.me/ctinow/198724...

PT-2024-21111 · Samly · Samly

Name of the Vulnerable Software and Affected Versions: Samly package versions prior to 1.4.0 for Elixir Description: The issue arises from the Samly.State.Store.get assertion/3 function, which can return an expired session. This interferes with access control because Samly.AuthHandler uses a cach...

CVE-2023-45718

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2023-45718 HCL Sametime is impacted by a failure to invalidate sessions

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

Liferay Portal's account lockout does not invalidate existing user sessions

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked...

GHSA-2MX7-XVFG-FG53 Liferay Portal's account lockout does not invalidate existing user sessions

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked...

Code injection

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked...

Session Hijacking

github.com/hashicorp/boundary is vulnerable to Session Hijacking. The vulnerability is due to improper certificate validation. An attacker with privileges to enumerate the active active or pending sessions can obtain a session key and obtain a valid trust on the token. This results in an attacker...

CVE-2024-1052

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052

Boundary and Boundary Enterprise are affected by CVE-2024-1052: session hijacking via TLS certificate tampering. The issue occurs when an attacker who can enumerate active/pending sessions, obtain a session private key, and possess a valid TOFU token can craft a TLS certificate to hijack an activ...

Authentication Bypass

Central Dogma is vulnerable to Authentication Bypass. The vulnerability is due to improper sanitization of the relayState within the SAML request. This issue can be exploited by an attacker to leak user sessions thus leading to authentication bypass...

Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-34q3-p352-c7q8. This link is maintained to preserve external references. Original Description Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage o...

CVE-2024-1143

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...

Cross site scripting

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...

CVE-2024-1143

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...

CVE-2024-1143

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage of user sessions and subsequent authentication bypass...

CVE-2023-50936

IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116...

CVE-2024-0924

creationtimestamp| type| source ---|---|--- 2024-01-26 16:32:26+00:00| seen| https://t.me/ctinow/174305 2024-01-28 10:28:07+00:00| seen| https://t.me/arpsyndicate/3269 2024-02-02 21:16:52+00:00| seen| https://t.me/ctinow/178279 2024-02-19 09:21:45+00:00| seen| https://t.me/ctinow/187525...

CVE-2024-23892

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/costcentercreate.php, in the costcenterid parameter. Exploitation of this...