1966 matches found
CVE-2025-32441 Rack session gets restored after deletion
Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the Rack::Session::Pool middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the...
IBM InfoSphere Information Server Access Control Error Vulnerability
IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. An access control error vulnerability exists in IBM InfoSphere Information Server version 11.7,...
CVE-2025-46815 ZITADEL Allows IdP Intent Token Reuse
The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id...
ZITADEL Allows IdP Intent Token Reuse
Impact ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to...
GHSA-G4R8-MP7G-85FQ ZITADEL Allows IdP Intent Token Reuse
Impact ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to...
IBM Sterling Connect:Direct Web Services Code Issue Vulnerability
IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A code issue vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from a browser closing without disabling the session, no details of the...
Security Bulletin: IBM Predictive Maintenance and Quality (PMQ) UI: Missing Secure Attribute in Encrypted Session (SSL) Cookie (CVE-2020-4423)
Summary PMQ UI web application sends non-secure cookies over SSL. It may be possible to steal user and session information cookies that was sent during an encrypted session. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...
The Hidden Risks of LLM-Generated Web Application Code: a Security-Centric Evaluation of Code Generation Capabilities in Large Language Models
The rapid advancement of Large Language Models LLMs has enhanced software development processes, minimizing the time and effort required for coding and enhancing developer productivity. However, despite their potential benefits, code generated by LLMs has been shown to generate insecure code in...
CVE-2025-28242
Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...
CVE-2025-28238
Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack...
CVE-2024-45651
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system...
CVE-2025-28242
Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...
CVE-2025-28238
Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack...
CVE-2025-28238
Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack...
PT-2025-17328
Name of the Vulnerable Software and Affected Versions DAEnetIP4 METO version 1.25 Description The issue is related to improper session management in the "/login ok.htm" endpoint, which allows attackers to execute a session hijacking attack. Recommendations For DAEnetIP4 METO version 1.25, conside...
Denkovi DAEnetIP4 METO 安全漏洞
Denkovi DAEnetIP4 METO is a multifunctional 10/100 Mb Ethernet device IP controller from Denkovi for management and control. A security vulnerability exists in Denkovi DAEnetIP4 METO version 1.25, which stems from improper session management in the /loginok.htm endpoint, and could lead to a sessi...
PT-2025-17327 · Elber · Elber Reble310
Name of the Vulnerable Software and Affected Versions: Elber REBLE310 Firmware version 5.5.1.R Description: The issue is related to improper session management, which allows attackers to execute a session hijacking attack. This can be exploited in the Elber REBLE310 equipment with the model numbe...
CVE-2025-28242
Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...
CVE-2025-28242
DAEnetIP4 METO v1.25 is affected by improper session management in the /login_ok.htm endpoint, enabling session hijacking. The issue, documented in multiple sources (CVE-2025-28242 and the DAEnetIP4 METO/Nuclei template), indicates attackers can hijack user sessions if they control or intercept s...