GHSA-89P3-9J8C-FQH4 Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references. Original Description This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open...

CVE-2021-46876

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...

CVE-2021-46876

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...

Ez Systems eZ Platform 安全漏洞

Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A security vulnerability exists in Ez Systems eZ Publish Ibexa Kernel versions prior to 7.5.15.1, which stems from misuse of the /user/sessions endpoint to determine if an account...

CVE-2021-46876

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...

Session invalidation should be propagated to other nodes in the cluster

In Jira there are some events like password change, user delete which invalidates user sessions. Currently those events only invalidate sessions on the node where the event was triggered. Those events should be propagated to other nodes...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

Cross-Site Request Forgery (CSRF)

openmage/magento-lts is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the resetPasswordPostAction function in AccountController.php because the user sessions are not properly managed which allows an attacker to change a user passwords...

CVE-2022-34451

PowerPath Management Appliance with versions 3.3 & 3.2, 3.1 & 3.0 contains a Stored Cross-site Scripting Vulnerability. An authenticated admin user could potentially exploit this vulnerability, to hijack user sessions or trick a victim application user into unknowingly send arbitrary requests to...

CVE-2022-34451

PowerPath Management Appliance with versions 3.3 & 3.2, 3.1 & 3.0 contains a Stored Cross-site Scripting Vulnerability. An authenticated admin user could potentially exploit this vulnerability, to hijack user sessions or trick a victim application user into unknowingly send arbitrary requests to...

TRENDnet TEW-652BRP Cross-Site Scripting Vulnerability

TRENDnet TEW-652BRP is a wireless router from TRENDnet USA. TRENDnet TEW-652BRP getset.ccp suffers from a cross-site scripting vulnerability, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can obtain sensitive information or hijack user...

CVE-2023-24494

A stored cross-site scripting XSS vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user...

CVE-2021-29368

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

Session fixation

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CVE-2021-29368

CVE-2021-29368 affects CuppaCMS with a session fixation flaw that allows an attacker to access arbitrary user sessions. Affected are versions prior to the commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 (Nov 12, 2019). Root cause is session handling that permits fixation, enabling unauthorized se...

CVE-2021-29368

Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...

CuppaCMS 授权问题漏洞

CuppaCMS is a content management system CMS. A security vulnerability exists in CuppaCMS that stems from the presence of a session fixation vulnerability, which can be exploited by an attacker to access arbitrary user sessions...

PT-2022-24784 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the offline access scope in Keycloak, affecting users of shared computers more, especially if cookies are not cleared. This issue is due to a lack of root session...

Insecure Session Management

IBM MQ is vulnerable to insecure session management. The vulnerability exists because the sessions are not properly terminated after logout which allows an attacker to get access to the user sessions of other users...

Insecure Session Management

rdiffweb is vulnerable to insecure session management. The vulnerability exists because user sessions are not properly defined with session persistent timeout which allows an attacker to access the active sessions of other users and perform unauthorized actions...