2437 matches found
CVE-2024-52311 data.all does not invalidate authentication token upon user logout
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired...
data.all 安全漏洞
data.all is an open source development framework from data-dot-all open source. A security vulnerability exists in data.all that stems from the fact that authentication tokens issued via Cognito in data.all do not expire upon logout, allowing previously authenticated users to continue to perform...
PT-2024-35171 · Amazon · Amazon Cognito
Name of the Vulnerable Software and Affected Versions: Amazon Cognito affected versions not specified Description: The issue allows previously authenticated users to continue executing authorized API requests until their authentication token expires, even after logging out. This is because...
Session Fixation
Umbraco is vulnerable to Session Fixation. The vulnerability is due to a session timeout discrepancy where the Backoffice logout page displays a session timeout message before the server session expires, leading users to believe they are logged out about 30 seconds early. It allows an attacker to...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the net/mlx5 module failing to properly log out of the notifier when eswitch initialization fails, which cou...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a race condition during the handling of smb2 session logout and setup, which could lead to memory reuse afte...
Doppler: Availability Impact from Exploiting Project Name Vulnerabilities
The vulnerability allowed a user to change the project name to a malicious string, which resulted in other users being logged out of their accounts when they attempted to access the project. This led to a denial of service for all users attempting to interact with the affected project, severely...
Umbraco CMS logout page displayed before session expiration
Impact The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are...
GHSA-FP6Q-GCCW-7QQM Umbraco CMS logout page displayed before session expiration
Impact The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are...
Umbraco CMS 授权问题漏洞
Umbraco CMS is a content management system from Umbraco, Denmark. An authorization issue vulnerability exists in Umbraco CMS that stems from a server session not being fully terminated during an explicit logout...
PT-2024-33274 · Umbraco · Umbraco
Name of the Vulnerable Software and Affected Versions: Umbraco versions 13.x prior to 13.5.2 Umbraco versions 10.x prior to 10.8.7 Umbraco versions 8.x prior to 8.18.15 Description: The issue is related to insufficient session expiration, where the Backoffice displays the logout page with a sessi...
CVE-2024-46326
Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function...
CVE-2024-46326
Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function...
PT-2024-31956 · Public Knowledge · Pkp-Lib
Name of the Vulnerable Software and Affected Versions: Public Knowledge Project pkp-lib versions 3.4.0-7 and earlier Description: The issue is related to an Open redirect vulnerability due to a lack of input sanitization in the logout function. Recommendations: For Public Knowledge Project pkp-li...
PKP Web Application Library 输入验证错误漏洞
PKP Web Application Library is a PKP open source library shared by Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS and Open Harvester System OHS. A security vulnerability exists in PKP Web Application Library 3.4.0-7 and earlier versions,...
CVE-2024-45462 Apache CloudStack: Incomplete session invalidation on web interface logout
The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out...
CVE-2024-45462 Apache CloudStack: Incomplete session invalidation on web interface logout
The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out...
PT-2024-31653 · Apache · Apache Cloudstack
Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.15.1.0 through 4.18.2.3 Apache CloudStack versions 4.19.0.0 through 4.19.1.1 Description: The logout operation in the CloudStack web interface does not expire the user session completely, which remains valid until...
PT-2024-37046 · Unknown · Password Pusher
Name of the Vulnerable Software and Affected Versions: Password Pusher versions 1.50.3 and prior Description: A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session tok...
