Cross-site scripting vulnerability exists in IR615 Router (CNVD-2021-82945)

The IR615 Router is a 4G industrial router from Rimu Technologies, China. IR615 Router has a cross-site scripting vulnerability that could be exploited to hijack user sessions connected to the system...

IR615 Router Cross-Site Scripting Vulnerability (CNVD-2021-82946)

The IR615 Router is a 4G industrial router from Rimu Technologies, China. IR615 Router has a cross-site scripting vulnerability that could be exploited to hijack user sessions connected to the system...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-37156

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...

CVE-2021-37156

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...

Authentication flaw

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...

CVE-2021-37156

Technical details such as affected products, versions, root cause, exploit information, or fixes are not publicly provided in the connected documents; monitor for updates from Redmine advisories and OSV/NVD feeds.

CVE-2021-37156

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...

CVE-2021-37156

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...

Redmine 代码问题漏洞

Redmine is a set of open source Web-based project management and defect tracking tools . The product provides project management, issue tracking, and role-based access control. A code issue vulnerability exists in Redmine that allows existing user sessions to continue with two-factor authenticati...

CVE-2021-22523

The vulnerability CVE-2021-22523 affects Micro Focus Verastream Host Integrator (version 7.8 Update 1 and earlier). It is an XML External Entity (XXE) issue in the product likely involving XML processing, with the described impact of controlling a web browser and hijacking user sessions. Connecte...

Joomla! 2.5.x < 3.9.28 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.28. It is, therefore, affected by multiple vulnerabilities. - Inadequate escaping in the Rules field of the JForm API leads to a Cross-Site Scripting XSS vulnerability...

Default credentials

An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked...

Joomla 2.5.x < 3.9.28 Multiple Vulnerabilities (5840-joomla-3-9-28)

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.28. It is, therefore, affected by multiple vulnerabilities. - Inadequate escaping in the Rules field of the JForm API leads to a XSS vulnerability. CVE-2021-26035 - Missing...

CVE-2021-35046

A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie...

Design/Logic Flaw

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session...

Information Disclosure

ezsystems/ezplatform-rest is vulnerable to information disclosure. The /user/sessions endpoint allows an attacker to discover valid accounts by analyzing the server response time...

/user/sessions endpoint allows detecting valid accounts

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...

/user/sessions endpoint allows detecting valid accounts

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...