487 matches found
CVE-2025-6515 Reuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers
The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses...
CVE-2025-56746
Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers...
CVE-2025-56746
Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers...
EUVD-2016-0374
Malware in sbrugna...
EUVD-2021-0041
Malware in sbrugna...
EUVD-2019-2112
Malware in sbrugna...
EUVD-2006-4091
Malware in sbrugna...
EUVD-2015-2892
Malware in sbrugna...
EUVD-2020-1453
Malware in sbrugna...
EUVD-2019-14018
Malware in sbrugna...
EUVD-2014-2233
Malware in sbrugna...
EUVD-2016-0921
Malware in sbrugna...
EUVD-2021-0702
Malware in sbrugna...
EUVD-2025-27768
Malicious code in bioql PyPI...
EUVD-2023-55133
Malicious code in bioql PyPI...
EUVD-2022-4355
Malicious code in bioql PyPI...
EUVD-2025-27767
Malicious code in bioql PyPI...
EUVD-2022-2297
Malicious code in bioql PyPI...
CVE-2025-40925 Starch versions 0.14 and earlier generate session ids insecurely
Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch...
CVE-2025-34188
CVE-2025-34188 affects Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 1.0.735 and Vasion Print Application prior to 20.0.1330 (macOS/Linux deployments). The root cause is a vulnerability in the local logging mechanism that stores authentication session tokens (PHPSESSID, XSR...