Hydro: Insufficient session expiration when recreating sessions

Impact Hydro contains an insufficient session expiration vulnerability in its session recreation logic. When a session is recreated, including during logout or other session renewal flows, Hydro creates a new session token but does not delete the previous server-side session token. As a result, a...

DEBIAN-CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

Pornhub: Unauthenticated access to Content Management System - www1.pornhubpremium.com

The researcher was able to get access to a CMS without authentication. This was an old server that should have been decommissioned. The issue was resolved and the researcher was awarded a bounty. Thank you Mak for the submission!...