CVE-2023-52424

CVE-2023-52424 describes an SSID confusion vulnerability in IEEE 802.11 where the SSID is not always used to derive PMK/session keys and the 4‑way handshake may proceed without a protected SSID exchange. An adjacent attacker can lure victims to connect to an unintended/untrusted network using Hom...

BIT-GITLAB-2020-13344

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis...

BIT-GITLAB-2021-22194

In all versions of GitLab, marshalled session keys were being stored in Redis...

Linux Kernel ksmbd Session Key Exchange Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable. The specific flaw exists within the processing of session keys. The iss...

@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys

Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control. Solution Usin...

Duplicate Advisory: Discovery uses the same AES/GCM Nonce throughout the session

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3hj-wr2q-x83g. This link is maintained to preserve external references. Original Description Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally...

The vulnerability in the implementation of Secure Connections Pairing and Secure Simple Pairing according to the Bluetooth Core Specification allows a attacker to carry out a “man-in-the-middle” attack.

The vulnerability of the Secure Connections Pairing and Secure Simple Pairing implementations in the Bluetooth Core Specification relates to the retrieval of session keys upon accessing a channel from a non-endpoint. Exploiting this vulnerability could allow an attacker to carry out a...

CVE-2023-35857

In Siren Investigate before 13.2.2, session keys remain active even after logging out...

CVE-2023-35857

In Siren Investigate before 13.2.2, session keys remain active even after logging out...

Code injection

In Siren Investigate before 13.2.2, session keys remain active even after logging out...

CVE-2023-35857

In Siren Investigate before 13.2.2, session keys remain active even after logging out...

PT-2023-25348 · Unknown · Siren Investigate

Name of the Vulnerable Software and Affected Versions: Siren Investigate versions prior to 13.2.2 Description: The issue concerns session keys remaining active even after a user logs out. This could potentially allow unauthorized access to user sessions. Recommendations: For versions prior to...

CVE-2023-35857

CVE-2023-35857 affects Siren Investigate prior to 13.2.2. The issue is that session keys remain active after logout, enabling potential unauthorized access to user sessions. The CVSS v3.1 score is 9.8 (CRITICAL) with network attack vector, no privileges required, and no user interaction. Affected...

CVE-2023-35857

In Siren Investigate before 13.2.2, session keys remain active even after logging out...

SUSE CVE-2015-5143

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service session store consumption via multiple requests with unique session keys...

Privilege Escalation

samba is vulnerable to Privilege Escalation. The vulnerability exists in the Window Kerberos RC4-HMAC component due to the weak rc4-hmac session keys for use between modern clients and servers...

rc4-hmac Kerberos session keys issued

Description Kerberos, the trusted third party authentication system at the heart of Active Directory, issues a session key known to the target server and the client, encrypted to both services in a TGS-REP. The key algorithm chosen for here is then used for the subsequent signed or encrypted...

USN-5690-1: libXdmcp vulnerability

It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain another user's key...

USN-5690-1 libxdmcp vulnerability

It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain another user's key...

Ubuntu 16.04 ESM : libXdmcp vulnerability (USN-5690-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5690-1 advisory. It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain anothe...