CVE-2021-41247

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials for the single-user server only, not the Hub reinstated...

PT-2021-23211 · Unknown · Jupyterlab +1

Name of the Vulnerable Software and Affected Versions: JupyterHub versions prior to 1.5 Description: The issue affects users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session. When logging out, fresh credentials for the single-user server are...

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

Description Attacker is able to logout a user if a logged in user visits attacker website. Impact This vulnerability is capable of forging user to unintentional logout. Test Tested on Edge, firefox, chrome and safari. Fix You should use POST instead of GET/ANY. To expand: One way GET/ANY could be...

Cross-Site Request Forgery (CSRF) in area17/twill

Description Attacker is able to logout a user if a logged in user visits attacker website. Impact This vulnerability is capable of forging user to unintentional logout. Test Tested on Edge, firefox, chrome and safari. Fix You should use POST instead of GET. To expand: One way GET could be abused...

Huawei EulerOS: Security Advisory for mod_auth_mellon (EulerOS-SA-2021-2597)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

pterodactyl/panel CSRF allowing an external page to trigger a user logout event

Impact A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. No user details are leaked, nor is any use...

GHSA-M49F-HCXP-6HM6 pterodactyl/panel CSRF allowing an external page to trigger a user logout event

Impact A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. No user details are leaked, nor is any use...

CVE-2021-41176

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted...

CVE-2021-41176

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted...

Design/Logic Flaw

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted...

CVE-2021-41176

CVE-2021-41176 describes a cross-site request forgery (CSRF) vulnerability in Pterodactyl Panel where a signed-in user can be logged out if they visit a malicious site that makes a request to the Panel’s sign-out endpoint. This requires targeting a specific Panel instance and only signs the user ...

CVE-2021-41176 logout CSRF in Pterodactyl Panel

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted...

Pterodactyl 跨站请求伪造漏洞

Pterodactyl is an open source game server administration panel built using PHP, Nodejs and Go. A cross-site request forgery vulnerability exists in versions of Pterodactyl prior to 1.6.3, which stems from a malicious user being able to trigger a user logout when a logged-in user accesses a...

Cross-Site Request Forgery (CSRF) in pterodactyl/panel

Description Attacker is able to logout a user if a logged in user visits attacker website. Impact This vulnerability is capable of forging user to unintentional logout. Test Tested on Firefox, Chrome and Safari. Fix You use POST instead of GET. To expand: One way ANY could be abused here is that ...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

Session Fixation in tsolucio/corebos

Description I created a user with username test then I log in with test in the same time on another session I delete the user test as an admin. but the user test that already logged in before that admin delete it is able to do anything that he could do before. you should kick out the users after...

in robotichead/nearbeach

Description Sensitive data on the application can be exposed after the user logout Proof of Concept 1 Login to the application https://demo.nearbeach.app/ 2 Goto page like My Account , or Any other page 3 Click logout 4 Click browser back button Impact When a user logs out without closing the...

CVE-2021-31378

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

Juniper Networks Junos OS 安全漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A security vulnerability exists in Juniper Networks Junos OS that arises from the fact that in broadband...

IceHrm Session Management Vulnerability

IceHrm is a human resource management Hrm system. The system includes features such as employee management, leave management and payroll management. A security vulnerability exists in IceHrm 30.0.0 OS, which stems from the fact that logging out from an administrator account does not invalidate an...