PT-2025-44280

Name of the Vulnerable Software and Affected Versions Jenkins SAML Plugin versions 4.583.vc68232f7018a and earlier Description The Jenkins SAML Plugin does not implement a replay cache. This allows attackers who can gather information about the SAML authentication process between a user’s web...

EUVD-2013-4960

Malware in sbrugna...

EUVD-2020-0344

Malware in sbrugna...

EUVD-2006-7179

Malware in sbrugna...

EUVD-2025-29517

Malicious code in bioql PyPI...

Taylored webhook validation vulnerabilities

Critical Security Advisory for Taylored npm package v7.0.7 - tag 7.0.5 Summary A series of moderate to high-severity security vulnerabilities have been identified specifically in version 7.0.7 of \taylored. These vulnerabilities reside in the "Backend-in-a-Box" template distributed with this...

GHSA-8G98-M4J9-QWW5 Taylored webhook validation vulnerabilities

Critical Security Advisory for Taylored npm package v7.0.7 - tag 7.0.5 Summary A series of moderate to high-severity security vulnerabilities have been identified specifically in version 7.0.7 of \taylored. These vulnerabilities reside in the "Backend-in-a-Box" template distributed with this...

CVE-2024-46040

IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after t...

CVE-2006-7200

EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end users, which makes it easier for attackers to bypass one stage of authentication by stealing and replaying a token...

Token Leakage

github.com/minio/operator is vulnerable to Token Leakage. The vulnerability is due to improper audience scoping of the defaulting of spec.audiences to the Kubernetes apiserver without proper restrictions, allowing tokens to be replayed to other internal systems...

MinIO Operator 安全漏洞

MinIO Operator is a simple Kubernetes operator for MinIO clusters from MinIO. A security vulnerability exists in MinIO Operator versions prior to 7.1.0, which stems from the failure to provide an audiences field, which could result in tokens being replayed...

Philips IntelliSpace Perinatal 授权问题漏洞

Philips IntelliSpace Perinatal is an obstetric care information management solution for the healthcare industry from Philips of the Netherlands. An authorization issue vulnerability exists in Philips IntelliSpace Perinatal, which originates in the Windows logon process, where AuthContext tokens...

CVE-2020-5261

Saml2 Authentication services for ASP.NET NuGet package Sustainsys.Saml2 greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patche...

PT-2024-31882 · Iot Haat · Iot Haat Smart Plug Ih-In-16A-S

Name of the Vulnerable Software and Affected Versions: IoT Haat Smart Plug IH-IN-16A-S version 5.16.1 Description: The issue is related to Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode allows an attacker to...

Session Hijacking 2.0 — The Latest Way That Attackers are Bypassing MFA

Attackers are increasingly turning to session hijacking to get around widespread MFA adoption. The data supports this, as: 147,000 token replay attacks were detected by Microsoft in 2023, a 111% increase year-over-year Microsoft. Attacks on session cookies now happen in the same order of magnitud...

CVE-2024-5249

In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed...

PT-2024-35330 · Akana · Akana Api Platform

Name of the Vulnerable Software and Affected Versions: Akana API Platform versions prior to 2024.1.0 Description: The issue allows SAML tokens to be replayed. Recommendations: For versions prior to 2024.1.0, update to version 2024.1.0 or later to resolve the issue...

CVE-2020-18701

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...

TaleLin Lin-CMS-Flask 访问控制错误漏洞

TaleLin Lin-CMS-Flask is a content management system framework. an access control error vulnerability exists in TaleLin Lin-CMS-Flask, stemming from incorrect access control in Lin-CMS-Flask v0.1.1, which could be exploited by an attacker to obtain sensitive information and/or because the...

GHSA-3P3G-VPW6-4W66 Authentication Bypass in hydra

Impact When using client authentication method "privatekeyjwt" 1, OpenId specification says the following about assertion jti: A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated betwe...