CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. This flaw allows an attacker to cause an Out of memory OOM issue, leading to a denial of service. The highest threat from this vulnerability is to system availability...

Audio Volume Persistence Tool

Description When a user reconnects to a XenApp session, all playback audio devices are reset to 100% volume level. Any playback volume settings previously made in the session are lost. This may also happen with a XenDesktop session. This tool restores the volume settings from values stored in the...

Session State Monitor Tool - XenApp/XenDesktop

Where to download ? Certain legacy Citrix tools are now available on request only. Please submit the request here - https://forms.gle/obA39PEz5qpDiSPq8 Once we verify your request, we will provide access to the download location. Description The Session State Monitor Utility actively monitors...

OpenSSL < 0.9.2b Session Reuse / ACL Bypass Vulnerability

OpenSSL allow remote attackers to reuse SSL sessions and bypass access controls. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Design/Logic Flaw

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout...

CVE-2020-15950

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout...

CVE-2020-15950

CVE-2020-15950 affects Immuta v2.8.2. The vulnerability is described as improper session management, where user sessions are not revoked upon logout. This indicates a potential persistence of sessions after logout, as stated in the provided descriptions. No explicit exploitation details, affected...

CVE-2020-25688

A flaw was found in rhacm. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository which resulted in all installations using the same certificates. If an attacker could observe network traffic internal to a cluster, they could use the private key...

IBM Planning Analytics Local and IBM Planning Analytics Workspace Information Disclosure Vulnerability

IBM Planning Analytics is a suite of business planning analytics solutions from IBM USA. The solution supports automated execution of business planning, budgeting, and analysis processes.Planning Analytics Workspace is the Web management interface for IBM Planning Analytics. An information...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 expose data to non-privileged users due to not invalidating TM1Web sessions (information disclosure). The issue affects Local 2.0.9.2 and Workspace 57, with remediation in IBM Planning Analytics Local 2.0.9.3 and Plannin...

CVE-2020-27650

Synology DiskStation Manager DSM before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-27739

A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...

CVE-2020-27739

A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...

Session fixation

A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...

Token Validation Bypass

parse-server is vulnerable to token validation bypass. Lack of checking deleted sessions after the websocket connection was established allows clients with invalid session tokens to still receive subscription object...

CVE-2020-15270

Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...

CVE-2020-15270

Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...