Session fixation

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

CVE-2018-1127

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

tendrl-api: Improper cleanup of session token can allow attackers to hijack user sessions

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

Credentials Replay

cas-client-core is vulnerable to credentials replay attacks. The cached assertions in CasLoginModulelogout method are not destroyed upon Logout, allowing for credentials to be replayed...

CVE-2016-0234

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM X-Force ID: 110303...

Code injection

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM X-Force ID: 110303...

CVE-2017-2646

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

CVE-2017-2646

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

Sql injection

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

CVE-2018-1492

IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out from the previous session. IBM X-Force ID: 140977...

Fedora 27 : php-symfony3 (2018-c8ddc44bbb)

3.3.17 2018-05-25 - security cve-2018-11407 Ldap cast to string when checking empty passwords - security cve-2018-11408 SecurityBundle Fail if security.httputils cannot be configured - security cve-2018-11406 clear CSRF tokens when the user is logged out - security cve-2018-11385 migrating sessio...

The vulnerability of the weblogin_log function in the D-Link DIR-629-B1 router’s microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the webloginlog function /htdocs/cgibin of the D-Link DIR-629-B1 router microprogramming system is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a denial-of-service attack by sending a specially crafted...

login.calliduscloud.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-633867 Description| Value ---|--- Affected Website:| login.calliduscloud.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

login.good.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-633823 Description| Value ---|--- Affected Website:| login.good.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Sensio Labs Symfony Security Component CSRF Vulnerability

Sensio Labs Symfony is the French company Sensio Labs a set of free , MVC-based PHP development framework , which provides commonly used functional components and tools , can be used to quickly create complex WEB program . Security is one of the security components . A security vulnerability exis...

Cross-Site Request Forgery (CSRF) Token Fixation

symfony/symfony is vulnerable to cross-site request forgery CSRF token fixation attacks. The vulnerability exists due to the lack of invalidation of CSRF tokens when a user logs out...

CVE-2018-11406

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...

DEBIAN-CVE-2018-11406

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...

Cross site request forgery (csrf)

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...

UBUNTU-CVE-2018-11406

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...