GHSA-C9H6-V78W-52WJ Keycloak vulnerable to session hijacking via re-authentication

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication having the query parameter prompt=login and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover...

PT-2024-21355 · Unknown · Recrystallize Server

Name of the Vulnerable Software and Affected Versions: ReCrystallize Server version 5.10.0.0 Description: The issue concerns an authorization mechanism that relies on the value of a cookie but does not bind this value to a session ID. This allows attackers to easily modify the cookie value within...

PT-2024-19194 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered in the Elspec G5 digital fault recorder. A hardcoded backdoor session ID exists that can be used for further access to the device, including...

CVE-2023-36483

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history...

CVE-2019-19580

creationtimestamp| type| source ---|---|--- 2024-03-10 14:11:53+00:00| seen| https://t.me/ctinow/204258...

CVE-2016-3131

creationtimestamp| type| source ---|---|--- 2024-02-28 10:41:10+00:00| seen| https://t.me/ctinow/195305...

The vulnerability lies in the implementation of the TLS protocol in the cURL command-line utility. This allows a hacker to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the TLS protocol’s command-line utility cURL stems from an erroneous preservation of the session identifier due to lack of verification of certificate revocation. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions and gain unauthorized...

Authentication flaw

An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legitimate users or...

CVE-2023-50920

GL.iNet devices prior to version 4.5.0 are affected by CVE-2023-50920, where the device assigns the same session ID after each reboot, enabling session ID reuse across sessions and bypassing authentication/access controls. Affected models include A1300 (4.4.6), AX1800 (4.4.6), AXT1800 (4.4.6), MT...

qBit MatUI Security Vulnerability

qBit MatUI is a material WebUI for qBittorrent by the individual developer Bilal Ahmed. A security vulnerability exists in qBit MatUI version 1.16.4, which stems from the presence of a cross-site scripting XSS vulnerability that allows remote attackers to obtain sensitive information via a fixed...

CVE-2018-8618

creationtimestamp| type| source ---|---|--- 2023-12-10 18:51:29+00:00| seen| https://t.me/arpsyndicate/1677...

CVE-2023-37504

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user...

CVE-2023-36638

An improper privilege management vulnerability CWE-269 in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may...

Broadcom RAID Controller Security Vulnerability

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation. A security vulnerability exists in the Broadcom RAID Controller that stems from an insecure HTTP in the web interface that prevents the protection of the SESSIONID cookie with the SameSite attribute...

CVE-2023-4110

A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument sessionid leads to cross site scripting. The attack can be launched...

PT-2023-8703 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is related to the improper validation of session id and tree id in compound requests in the Linux kernel's ksmbd module. Specifically, the smb2 get msg function in smb2 get...

CVE-2023-22053

creationtimestamp| type| source ---|---|--- 2023-07-19 00:36:38+00:00| seen| https://t.me/cibsecurity/66972 2023-11-15 16:53:23+00:00| published-proof-of-concept| https://t.me/BABATATASASA/5992...

CVE-2023-34656

An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackers to gain escalated privileges...

CVE-2023-34656

An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackers to gain escalated privileges...

Xiamen Si Xin Communication Technology Video management system 安全漏洞

Xiamen Si Xin Communication Technology Video management system is a video management system from Xiamen Si Xin Communication Technology Xiamen, China. A security vulnerability exists in Xiamen Si Xin Communication Technology Video management system versions 3.1 through 4.1, which can be exploited...