Hydro: Insufficient session expiration when recreating sessions

Impact Hydro contains an insufficient session expiration vulnerability in its session recreation logic. When a session is recreated, including during logout or other session renewal flows, Hydro creates a new session token but does not delete the previous server-side session token. As a result, a...

Nextcloud Server 授权问题漏洞

NextCloud Server is an open-source NextCloud server program developed by NextCloud. Versions of NextCloud Server from 32.0.0 to 32.0.9 and from 33.0.0 to 33.0.3 contained vulnerabilities related to authorization. These vulnerabilities stemmed from the possibility that the session cookie, which...

Devolutions Server 安全漏洞

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. Versions of Devolutions Server prior to 2026.1.11 contained a security vulnerability. This vulnerability stemmed from...

FreeBSD : typo3 -- Multiple vulnerabilities (7cc003cb-83b9-11ee-957d-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7cc003cb-83b9-11ee-957d-b42e991fc52e advisory. - TYPO3 is an open source PHP based web content management system released under the GNU GPL. ...

TYPO3 Security Vulnerabilities

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. TYPO3 suffers from a security vulnerability that stems from the fact that a session cookie generated for a first site can be reused on a second site without additional authentication...

TYPO3 8.0.0 < 8.7.55 ELTS / 9.0.0 < 9.5.44 ELTS / 10.0.0 < 10.4.41 ELTS / 11.0.0 < 11.5.33 / 12.0.0 < 12.4.8 (TYPO3-CORE-SA-2023-006)

The version of TYPO3 installed on the remote host is prior to 8.0.0 8.7.55 ELTS / 9.0.0 9.5.44 ELTS / 10.0.0 10.4.41 ELTS / 11.0.0 11.5.33 / 12.0.0 12.4.8. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2023-006 advisory. - Given that there are at least two...

Vulnerabilities fixed in Apache HTTP Server

Several vulnerabilities have been fixed in Apache HTTP Server. A remote malicious party could potentially exploit the vulnerabilities to cause a denial-of-service or to reuse an expired session cookie to be reused. Apache Software Foundation has made updates available for Apache HTTP Server to...