CVE-2022-2572

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked...

PT-2022-24077 · Unknown · Mysql Server +1

Name of the Vulnerable Software and Affected Versions: Remote Desktop Manager versions 2022.3.7 and prior Description: The issue allows deleted users to access unauthorized data due to active database connections on MySQL data sources. Recommendations: For Remote Desktop Manager versions 2022.3.7...

GHSA-8QXP-G8JV-P37X Improper Authorization in Jenkins Core

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have...

USN-5052-1 mongodb vulnerability

MongoDB would fail to properly invalidate existing sessions for deleted users. This could allow a remote authenticated attacker to gain elevated privileges if their user account was recreated with elevated privileges...

The vulnerability of the SNMP-trap SNMPTT handler, due to improper checking of deleted users, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SNMP-trap handler SNMPTT is related to improper verification of removed users. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures...

Revive Adserver Unauthorized Operation Vulnerability

Revive Adserver is an open source ad management system from the Revive Adserver team. A security vulnerability in Revive Adserver versions prior to 3.2.2 can be exploited by remote attackers to perform restricted operations with the help of unexpired sessions established by deleted or disconnecte...

autocomplete box in page restrictions finds deleted users, wrong usernames

We recently migrated our user management from JIRA to Crowd, our Confluence instance used to link to JIRA for authentication, and now links to Crowd. We now found that, when editing the restrictions on individual pages, the autocomplete feature in that dialog acts strange: Users that have been...