595 matches found
Session fixation
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database for database session backen...
PYSEC-2023-158
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database for database session backen...
CVE-2023-40273 Session fixation in Apache Airflow web interface
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database for database session backen...
CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be abused if a Kirby user is logged in on a device or browser th...
CVE-2023-37946
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the previous session on login...
CVE-2023-37946
CVE-2023-37946 concerns the Jenkins OpenShift Login Plugin (versions up to 1.1.0.227.v27e08dfb_1a_20 and earlier) where login does not invalidate the previous session, enabling session fixation. The CVSSv3.1 base score is 8.8 (HIGH) with NETWORK attack vector, user interaction required. Red Hat a...
CVE-2023-33005
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login...
CVE-2023-32997
Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...
CVE-2023-33005
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login...
CVE-2023-32997
The CVE-2023-32997 entry concerns the Jenkins CAS Plugin (versions 1.6.2 and earlier) that does not invalidate the existing session on login, enabling a session fixation risk. Multiple connected sources corroborate this behavior and describe it as allowing an attacker to potentially gain administ...
CVE-2023-32997
Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...
CVE-2023-28316
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled...
CVE-2020-4914
The CVE-2020-4914 issue affects IBM Cloud Pak System Software Suite 2.3.3.0–2.3.3.5, where sessions are not invalidated on logout, potentially allowing a local user to impersonate another user. This vulnerability concerns the logout/session handling component in IBM Cloud Pak System UI and REST A...
Session invalidation should be propagated to other nodes in the cluster
In Jira there are some events like password change, user delete which invalidates user sessions. Currently those events only invalidate sessions on the node where the event was triggered. Those events should be propagated to other nodes...
Jenkins plugins Multiple Vulnerabilities (2023-01-24)
According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - High Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are...
K51975973: Eclipse Jetty vulnerability CVE-2021-34428
Security Advisory Description For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can...
Security Bulletin: IBM MQ Appliance is vulnerable to improper session invalidation (CVE-2022-40230)
Summary IBM MQ Appliance has resolved an improper session validation vulnerability. Vulnerability Details CVEID:CVE-2022-40230 DESCRIPTION: IBM MQ Appliance does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. CVSS Base score:...
CVE-2023-24444
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login...