1726 matches found
The vulnerability of Intel processors, related to the microarchitectural data retrieval from non-cached memory (MDSUM), allows attackers to exploit this to disclose protected information.
The vulnerability of Intel processors is related to the microarchitectural data cache invalidation mechanism MDSUM. Exploiting this vulnerability can allow an attacker to disclose protected information...
Linux Kernel Flaw Allows Remote Code-Execution
Millions of Linux systems could be vulnerable to a high-impact race condition flaw in the Linux kernel. Kernel versions prior to 5.0.8 are affected by the vulnerability CVE-2019-11815, which exists in the rdstcpkillsock in net/rds/tcp.c. “There is a race condition leading to a use-after-free UAF,...
Incorrect Session Invalidation
Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...
Command injection
User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...
CVE-2019-11514
User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...
CVE-2019-11514
Summary (CVE-2019-11514): In Flarum core, the file User/Command/ConfirmEmailHandler.php mishandles invalidation of user email tokens prior to 0.1.0-beta.8. This creates insecure session management where email tokens can be reused, potentially enabling a remote attacker to gain access to a user ac...
Incorrect Session Invalidation
Contao has done incorrect session invalidation. It does not perform correct session invalidation for existing sessions when users update their passwords in frontend or backend...
Existing sessions are not correctly invalidated when a user changes their password
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10641.html...
Session invalidation upon password changes
Date : 2019-04-09 CVE ID : CVE-2019-10641 Description Security researcher Ali Razzaq has discovered that existing sessions are not correctly invalidated when a user changes their password in the back end or front end. Affected versions Contao 3. up to 3.5.38 Contao 4.0 Contao 4.1 Contao 4.2 Conta...
GitLab: Persistent XSS in Note objects
Summary: Some cache invalidation and project import logic issues enable an attacker to import a project with XSS payloads in places like MR discussions and similar places where a Note object exists. Description: There are basically 3 issues causing the XSS here: All attributes of Note objects are...
SUSE-SU-2019:0552-1 Security update for sssd
This update for sssd fixes the following issues: Security vulnerability fixed: - CVE-2019-3811: Fix fallbackhomedir returning '/' for empty home directories bsc1121759 Other bug fixes and changes: - Skip sdapsavegrpmem if ignoregroupmembers is set. bsc1082568 - Only search for primary group if it...
CVE-2018-1962
IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658...
Session fixation vulnerability in GitHub Authentication Plugin
GitHub Authentication Plugin did not invalidate the previous session and create a new one upon successful login, allowing attackers able to control or obtain another user's pre-login session ID to impersonate them. GitHub Authentication Plugin now invalidates the previous session during login and...
jenkins -- multiple vulnerabilities
Jenkins Security Advisory: Description High SECURITY-868 Administrators could persist access to Jenkins using crafted 'Remember me' cookie Medium SECURITY-901 Deleting a user in an external security realm did not invalidate their session or 'Remember me' cookie...
Improper Token Invalidation
The openstack-keystone packages is vulnerable to improper token invalidation. It is possible because it does not revoke the tokens issued to a tenant upon disabling the tenant, leaving the tenant to access the resources supposed to be restricted...
Code execution through crafted URLs
Jenkins uses the Stapler web framework for HTTP request handling. Stapler's basic premise is that it uses reflective access to code elements matching its naming conventions. For example, any public method whose name starts with get, and that has a String, int, long, or no argument can be invoked...
CVE-2018-6088
An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file...
CVE-2018-6088
An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file...
