GHSA-7VWG-39H8-8QP8 /user/sessions endpoint allows detecting valid accounts

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...

Cross site scripting

Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability, to hijack user sessions or to trick a victim application user to unknowingly send arbitrary requests to the server...

CVE-2021-21515

CVE-2021-21515 affects Dell EMC SourceOne, versions 7.2SP10 and earlier. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw that could be exploited by a remote, low-privileged attacker to hijack user sessions or coerce a victim application user into sending arbitrary requests to the se...

CVE-2021-21032

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation...

CVE-2021-21031

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation...

CVE-2021-21031

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation...

CVE-2020-12495

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...

Design/Logic Flaw

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...

CVE-2020-12495

The CVE-2020-12495 entry concerns Endress+Hauser Ecograph T (Neutral/Private Label) devices (RSG35, ORSG35) with firmware

Design/Logic Flaw

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout...

CVE-2020-15950

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout...

CVE-2020-15950

CVE-2020-15950 affects Immuta v2.8.2. The vulnerability is described as improper session management, where user sessions are not revoked upon logout. This indicates a potential persistence of sessions after logout, as stated in the provided descriptions. No explicit exploitation details, affected...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 expose data to non-privileged users due to not invalidating TM1Web sessions (information disclosure). The issue affects Local 2.0.9.2 and Workspace 57, with remediation in IBM Planning Analytics Local 2.0.9.3 and Plannin...

CVE-2020-15175

In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”...

Clickjacking Attack

Node.js is vulnerable to clickjacking. An attacker can perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the...

Design/Logic Flaw

Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...

CVE-2020-8201

Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...

CVE-2020-8201

Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...

Authentication flaw

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...