2489 matches found
CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...
CVE-2022-24744 Insufficient Session Expiration in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...
Open Redirect
djangospirit is vulnerable to open redirect. The vulnerability exists because the return url parameter is not properly validated during login, logout, register, and resend-activation, which allows an attacker to parse malicious URLs to redirect the user...
Open Redirect in django-spirit
django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register,...
GHSA-5P9J-W2WX-QX4C Open Redirect in django-spirit
django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register,...
IBM MQ Appliance code issue vulnerability
IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. A code issue vulnerability exists in the IBM MQ Appliance, which stems from the IBM MQ appliance not invalidating a session after logging out, and could be exploited by an...
CVE-2021-38986
IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942...
CVE-2021-38986
The CVE-2021-38986 issue affects IBM MQ Appliance 9.2 CD and 9.2 LTS, where sessions are not invalidated after logout, allowing an authenticated user to impersonate another user. Root cause is insufficient session expiration. IBM/IBM X-Force assign a base CVSS around medium (5.6). Remediation: up...
CVE-2021-38986
IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942...
JetBrains TeamCity Code Issue Vulnerability (CNVD-2022-18623)
JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. The tool provides continuous unit testing, code quality analysis, and build issue analysis reports.JetBrains TeamCity has a code issue vulnerability that stems from the product's...
IBM MQ Appliance 代码问题漏洞
IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. A code issue vulnerability exists in the IBM MQ Appliance, which stems from the IBM MQ appliance not invalidating a session after logging out, and could be exploited by an...
CVE-2021-38986
IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
Design/Logic Flaw
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
The CVE-2022-24332 entry applies to JetBrains TeamCity prior to 2021.2, where the logout action did not remove the Remember Me cookie. This is documented in multiple sources (NVD/NVD lists the issue; Red Hat and CNVD references reiterate the same description). The JetBrains Security Bulletin Q4 2...
Multiple Open Redirect
Description In the /user/login endpoint, it doesnt check the value of the next parameter when the user is logged in and pass it directly to redirect which result to open redirect. The bug also exist in /user/logout, /user/register, /user/login, /user/resend-activation. Proof of Concept 1. Go to...
Cross-site Scripting (XSS) - Reflected in cortezaproject/corteza-server
Description The logout function doesn't clean/filter value of "back" parameter before reflecting into html code leading to Reflected XSS vulnerability. Proof of Concept Visit URL: https://latest.cortezaproject.org/auth/logout?back=%22%3E%3Cscript%3Ealertorigin%3C/script%3E%3C%22 Poc:...