CVE-2025-66289 OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, o...

CVE-2025-53896 Kiteworks MFT is vulnerable to Insufficient Session Expiration

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0...

Kiteworks Mft 代码问题漏洞

Kiteworks Mft is a software for securely managing internal and external data transfers from Kiteworks USA. A code issue vulnerability exists in Kiteworks Mft versions prior to 9.1.0 that stems from an improper session timeout mechanism that could cause a session to remain active...

PT-2025-48367

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.7 Description OrangeHRM does not invalidate existing sessions when a user is disabled or a password change occurs, allowing active session cookies to remain valid indefinitely. This allows a disabled user, or a...

CVE-2025-13762

Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305...

CVE-2025-13762 Client-Side Denial of Service Condition in SWS Extension prior to version 2.2.30305

Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305...

CVE-2025-13762 Client-Side Denial of Service Condition in SWS Extension prior to version 2.2.30305

Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305...

EUVD-2025-199782

Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305...

CVE-2025-13762

CVE-2025-13762 affects the CyberArk Secure Web Sessions Extension for Chrome/Edge. The root cause is improper input validation in the extension, leading to a Denial of Service when starting new SWS sessions. Affected versions are before 2.2.30305. Exploitation is noted as possible with local vect...

CyberArk Secure Web Sessions Extension 安全漏洞

CyberArk Secure Web Sessions Extension is a browser extension from CyberArk, Israel. has the ability to log, audit, and protect user sessions of web applications accessed through CyberArk Identity SSO to prevent data leakage, unauthorized operations, or session hijacking. A security vulnerability...

PT-2025-48223

Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305...

Improper Input Validation

OpenVPN is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of source IP addresses during session handling, which allows an attacker to open a session from a different IP address than the one that initiated the connection and cause a denial of service for t...

EUVD-2025-199765

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions...

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

Summary A vulnerability was identified in the multi-session plugin for Better Auth, specifically in the /sign-out after-hook. The hook trusts raw multi-session cookies and forwards the extracted values directly to internalAdapter.deleteSessions without verifying the cookie signature. Because cook...

kernel: smb: client: fix potential UAF in cifs_stats_proc_write()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifsstatsprocwrite Skip sessions that are being teared down status == SESEXITING to avoid UAF...

keycloak: org.keycloak:keycloak-services: User can refresh offline session even after client's offline_access scope was removed

A flaw was found in Keycloak. An offline session continues to be valid when the offlineaccess scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and...

EUVD-2025-199355

Malicious code in shelf-jwt-sessions npm...

MAL-2025-191423 Malicious code in shelf-jwt-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bccf31522a4305a972564f73554c2b148fd28428cce67b3e73edd235aec25a84 The package shelf-jwt-sessions was found to contain malicious code. Source: google-open-source-security...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Privilege Escalation

github.com/canonical/lxd is vulnerable to Privilege Escalation. The vulnerability is due to improper authorization in the Operations API, where an attacker with only read permissions can hijack terminal or console WebSocket sessions and execute arbitrary commands...