Insecure Cookie Handling

symfony/security-bundle vulnerable to Insecure Cookie Handling attacks. The vulnerability exists because the remember me cookie does not properly invalidate the session after the password change. An attacker could use this flaw to steal sensitive user information and gain access to the applicatio...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

Cross site scripting

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985

In Factor (App Framework & Headless CMS) from v1.0.4 through v1.8.30, the vulnerability stems from improperly invalidating a user session after logout and storing sessions in browser local storage (which has no expiration). This enables an attacker to steal and reuse session data via XSS, potenti...

Darwin Factor 代码问题漏洞

Darwin Factor is a free and open source next-generation TypeScript framework from Darwin, Inc. It is used to create blogs, login pages, and JamStack applications. Darwin Factor has a security vulnerability that stems from incorrectly invalidating a user's session even after the user logs out of t...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

CVE-2021-35214

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...

CVE-2021-35214

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...

CVE-2021-35214

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...

Design/Logic Flaw

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...

Solarwinds SolarWinds Pingdom 代码问题漏洞

Solarwinds SolarWinds Pingdom is a complete website monitoring platform from Solarwinds, Inc. It is used to measure the latency of the websites it monitors. A security vulnerability exists in several solarwinds products. The vulnerability stems from the inability to invalidate a user's session...

CVE-2021-20473

IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 196944...

Code injection

IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 196944...

Jetty 10.0.x < 10.0.3 Multiple Vulnerabilities

According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities: - An issue with failure to invalidate sessions after an exception in t...

Jetty < 9.4.41 Multiple Vulnerabilities

According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities: - An issue with failure to invalidate sessions after an exception in t...

Laravel Booking System Booking Core 代码问题漏洞

A code issue vulnerability exists in Laravel Booking System Booking Core, a reservation system, which originates from sandbox.bookingcore.org/user/profile/change- password does not invalidate a session opened in a different browser. No details of the vulnerability are currently available...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

USN-5052-1 mongodb vulnerability

MongoDB would fail to properly invalidate existing sessions for deleted users. This could allow a remote authenticated attacker to gain elevated privileges if their user account was recreated with elevated privileges...