ovirt-engine: webadmin log out must logout all sessions

It was discovered that the ovirt-engine webadmin session would not properly enforce timeouts. Browser sessions would remain logged in beyond the administratively configured session timeout period...

Catalyst Mahara User Login Vulnerability

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara versions 15.04 prior to 15.04.8, 15.10 prior to 15.10.4, and 16.04 prior to 16.04.2, which stems fr...

Catalyst Mahara Session Fixation Vulnerability

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara version 15.04 prior to 15.04.7 and version 15.10 prior to 15.10.3, which stems from a session ID no...

CVE-2017-1000131

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle when using MNet as Mahara did not properly implement one of the MNet SSO API functions...

Automated Logout - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-081

This module provides a site administrator the ability to log users out after a specified time of inactivity. It is highly customizable and includes "site policies" by role to enforce log out. The module does not sufficiently filter user-supplied text that is stored in the configuration, resulting...

Red Hat oVirt Privilege Acquisition Vulnerability

Red Hat Ovirt is the United States Red Hat Red Hat company's set of open source virtualization management platform , is the RHEV enterprise virtualization platform of the open source version , by ovirt-node client and overt-engine management side . A security vulnerability exists in Red Hat oVirt...

UBUNTU-CVE-2015-6961

Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to user/logout...

CVE-2015-6961

Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to user/logout...

CVE-2015-6961

Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to user/logout...

CVE-2015-6961

CVE-2015-6961 is an open redirect vulnerability affecting Web2py 2.9.11 in the gluon/tools.py file. The issue allows a remote attacker to craft a URL with the _next parameter (to user/logout) that redirects victims to an arbitrary site, enabling phishing-style redirects. Public references confirm...

PT-2017-7097

Name of the Vulnerable Software and Affected Versions Web2py version 2.9.11 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved by manipulating a URL in the next parameter to the user/logout endpoint. Recommendation...

PT-2017-6113 · Red Hat · Ovirt

Name of the Vulnerable Software and Affected Versions: oVirt versions 3.2.2 through 3.5.0 Description: The issue allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user, due to the...

ProMinent MultiFLEX M10a Controller Authentication Bypass Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. An authentication bypass vulnerability exists in ProMinent MultiFLEX M10a Controller, where the logout feature in the application deletes a user's session on the client side only. An attacker can exploit the vulnerability to bypass...

Rapid7 Cross-Site Request Forgery Vulnerability

Rapid7 Metasploit Pro is a suite of penetration testing software from the US company Rapid7. A cross-site request forgery vulnerability exists in the Web UI in versions prior to Rapid7 Metasploit 4.14.1-20170828. A remote attacker could exploit this vulnerability to cause a denial of service forc...

CVE-2017-15084

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2017-15084

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

Cross site request forgery (csrf)

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2017-15084

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2017-15084: Cross-Site Request Forgery (CSRF)

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

PT-2017-13863

Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit versions prior to 4.14.1-20170828 Description The issue concerns a logout CSRF in the web UI. Recommendations For versions prior to 4.14.1-20170828, update to version 4.14.1-20170828 or later to resolve the issue...