cve-2018-11714_POC

cve-2018-11714POC TP-Link TL-WR840N において問題が発見されました。この問題は、/cgi/ フォルダまたは /cgi ファイルにおける不適切なセッション処理によって引き起こされます。攻撃者がヘッダー "Referer: http://192.168.0.1/mainFrame.htm" を送信すると、あらゆる操作に対して認証が不要になります。 記事 pt-br: https://nous.sidneypepo.com/router2025.html...

CVE-2026-82053

MongoDB Server's LDAP authorization integration is affected by an improper session handling issue. Under certain configurations, pooled LDAP connections can retain stale authentication identities after user authentication. Subsequent authorization queries may then execute under an unintended LDAP...

DAEnetIP4 METO v1.25 - Session Hijacking

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. id: CVE-2025-28242 info: name: DAEnetIP4 METO v1.25 - Session Hijacking author: 0xAkoko severity: high...

CVE-2025-62342

HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability where user sessions may not be fully terminated after logout or deletion, due to improper session handling. The vulnerability carries a CVSS 3.1 score of 6.4 (Medium) with high impacts to confidentiality and ava...

CVE-2025-62342 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion...

EUVD-2026-58388

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

CVE-2026-17045 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

CVE-2026-17045

CVE-2026-17045 affects IBM i 7.6, 7.5, 7.4, and 7.3 due to improper session management that can allow a remote authenticated attacker to perform unauthorized operations and access sensitive information. The vulnerability is categorized under CWE-294 (Authentication Bypass by Capture-replay) with ...

PT-2026-71828

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

EUVD-2026-50887

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-61452

The Grav API plugin (getgrav/grav-plugin-api) up to version 2.0.3 has an improper session invalidation flaw: JWT access tokens are issued without a jti (JWT ID) claim and cannot be revoked server-side. Access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, passw...

PYSEC-2026-731 Plone Improper Session Management

Plone CMS before 3, places a base64 encoded form of the username and password in the ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network...

PYSEC-2026-734 Plone CMS Improper Session Management

Plone CMS before 3 places a base64 encoded form of the username and password in the ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network...

CVE-2026-46401

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication tokens remain valid after user logout. This allows attackers who obtain valid tokens to maintain persistent access to...

EUVD-2026-34895

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication tokens remain valid after user logout. This allows attackers who obtain valid tokens to maintain persistent access to...

CVE-2026-46401 HAX CMS PHP has Insufficient Session Expiration

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication tokens remain valid after user logout. This allows attackers who obtain valid tokens to maintain persistent access to...

ROS-20260529-73-0015

The vulnerability in openbao is related to improper session management. Exploiting this vulnerability can allow a remote attacker to intercept a user’s session...

Authentication Bypass

Soft Serve is vulnerable to Authentication Bypass. The vulnerability is due to improper session context handling during the SSH authentication process, which allows an attacker to impersonate any user by offering the victim's public key before authenticating with their own valid key...

EUVD-2026-24128

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page...

Improper Session Invalidation

github.com/usememos/memos is vulnerable to improper session invalidation. The vulnerability is due to access tokens not being revoked after a password change, which allows an attacker to retain unauthorized access using previously issued valid tokens...