Improper Session Invalidation

ethycafides is vulnerable to improper session invalidation. The vulnerability is due to active user sessions not being invalidated after an admin UI password change, which allows an attacker with previously obtained session tokens to maintain unauthorized access even after a password reset...

PT-2025-41807

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.2.27 Mastodon versions prior to 4.3.14 Mastodon versions prior to 4.4.6 Description Mastodon is a free, open-source social network server based on ActivityPub. When an administrator resets a user account’s password...

EUVD-2020-15893

Malware in sbrugna...

EUVD-2018-14263

Malware in sbrugna...

EUVD-2004-0943

Malware in sbrugna...

EUVD-2023-32023

Malicious code in bioql PyPI...

EUVD-2022-36963

Malicious code in bioql PyPI...

EUVD-2024-42721

Malicious code in bioql PyPI...

EUVD-2025-4305

Malicious code in bioql PyPI...

EUVD-2024-1321

Malicious code in bioql PyPI...

EUVD-2022-1334

Malicious code in bioql PyPI...

CVE-2025-30039

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges...

CGM CLININET Access Control Error Vulnerability (CNVD-2025-19807)

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from an access control error vulnerability that originates from improper access control in /cgi-bin/CliniNET.prd/GetActiveSessions.pl, which can be exploited by an attacker to gain unauthorized access ...

CVE-2025-30039 Missing authentication in API returning a list of all active sessions

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges...

CVE-2025-30039 Missing authentication in API returning a list of all active sessions

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges...

PT-2025-34846 · Clininet · Clininet

Name of the Vulnerable Software and Affected Versions: CliniNET affected versions not specified Description: Unauthenticated access to the /cgi-bin/CliniNET.prd/GetActiveSessions.pl endpoint allows takeover of any user session logged into the system, including those with administrative privileges...

CVE-2025-49651

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...

GHSA-HXVR-GG2W-J48X BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...

CVE-2025-49653

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...

Improperly Implemented Security Check for Standard

Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard due to the exposure of sensitive data in active sessions. An attacker can retrieve credentials for users on the management platform by exploiting this vulnerability. Note: The maintaine...