CVE-2024-20301: Improper Authentication

A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and access an affected Windows device. This vulnerability is due to a failure to invalidate locally created trusted sessions after a reboot of t...

PT-2024-22134 · Symfony +2 · Symfony +2

Name of the Vulnerable Software and Affected Versions: Shopware versions 6.5.8.0 through 6.5.8.6 Description: The issue arises from the Symfony Session Handler popping the Session Cookie and assigning it to the Response. Since Shopware 6.5.8.0, 404 pages are cached to improve performance, resulti...

CVE-2024-21722

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...

CVE-2024-21722

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...

Information disclosure

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...

CentOS 9 : xorg-x11-server-Xwayland-21.1.3-5.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the xorg-x11-server-Xwayland-21.1.3-5.el9 build changelog. - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in...

CentOS 9 : tigervnc-1.12.0-9.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the tigervnc-1.12.0-9.el9 build changelog. - A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory...

CVE-2024-26342

creationtimestamp| type| source ---|---|--- 2024-02-28 19:26:59+00:00| seen| https://t.me/ctinow/195775 2024-02-28 19:27:06+00:00| seen| https://t.me/ctinow/195781 2025-04-22 16:03:14+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12876...

CVE-2024-24705

creationtimestamp| type| source ---|---|--- 2024-02-28 16:46:39+00:00| seen| https://t.me/ctinow/195644 2024-02-28 16:46:43+00:00| seen| https://t.me/ctinow/195648 2024-03-15 01:07:08+00:00| seen| https://t.me/ctinow/208320...

PT-2024-1897 · Cisco · Cisco Nx-Os +1

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS affected versions not specified Description: A vulnerability in the External Border Gateway Protocol eBGP implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS...

Rails has possible Sensitive Session Information Leak in Active Storage

Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxi...

[SECURITY] Fedora 38 Update: sofia-sip-1.13.12-2.fc38

Sofia SIP is a RFC-3261-compliant library for SIP user agents and other network elements. The Session Initiation Protocol SIP is an application-layer control signaling protocol for creating, modifying, and terminating sessions with one or more participants. These sessions include Internet telepho...

@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys

Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control. Solution Usin...

GHSA-84C3-J8R2-MCM8 @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys

Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control. Solution Usin...

PT-2024-40180 · Unknown · @Nfid/Embed Sdk +2

Name of the Vulnerable Software and Affected Versions: @nfid/embed SDK versions prior to 0.10.1-alpha.6 @dfinity/auth-client versions prior to 1.0.1 @dfinity/identity versions prior to 1.0.1 Description: The issue affects user sessions in the @nfid/embed SDK that utilize Ed25519 keys, due to a...

CVE-2023-52448

creationtimestamp| type| source ---|---|--- 2024-02-22 18:54:02+00:00| seen| https://t.me/ctinow/191024 2024-02-23 15:11:35+00:00| seen| https://t.me/ctinow/191800...

CVE-2023-52153

A SQL Injection vulnerability in /pmb/opaccss/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQL commands via the PmbOpac-LOGIN cookie value...

PMB SQL Injection Vulnerability

PMB is a 100% free document management reference tool from the PMB Services team. A SQL injection vulnerability exists in PMB 7.4.7 and prior versions, which originates from a vulnerability that could allow an unauthenticated, remote attacker to inject arbitrary SQL commands via the PmbOpac-LOGIN...

PT-2024-13342 · Discourse · Discourse-Microsoft-Auth

Name of the Vulnerable Software and Affected Versions: discourse-microsoft-auth plugin affected versions not specified Description: The discourse-microsoft-auth plugin enables authentication via Microsoft. On sites with this plugin enabled, an attack can potentially take control of a victim's...

CVE-2024-21722 [20240201] - Core - Insufficient session expiration in MFA management views

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...