CVE-2025-34269

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60424...

CVE-2025-34269

This CVE-2025-34269 entry concerns Nagios Fusion prior to R2.1, where the application does not require re-authentication or session rotation after a user enables 2FA. A valid session may persist after 2FA is enabled, enabling potential persistent account takeover and undermining the legitimate us...

CVE-2025-62723

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon eventual session expiration. Version 1.23.2 fixes the issue...

EUVD-2020-26268

Malware in sbrugna...

EUVD-2017-1420

Malware in sbrugna...

EUVD-2017-1416

Malware in sbrugna...

EUVD-2019-12028

Malware in sbrugna...

EUVD-2003-1085

Malware in sbrugna...

EUVD-2025-26634

Malicious code in bioql PyPI...

EUVD-2023-49950

Malicious code in bioql PyPI...

EUVD-2022-4624

Malicious code in bioql PyPI...

EUVD-2024-37263

Malicious code in bioql PyPI...

EUVD-2022-46527

Malicious code in bioql PyPI...

GHSA-RPW8-82V9-3Q87 Fides' Admin UI User Password Change Does Not Invalidate Current Session

Summary Admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors such as XSS can maintain access even after password reset. This issue is not directly...

CVE-2025-55162

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. Whe...

Linux Distros Unpatched Vulnerability : CVE-2019-2386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated...

Envoy 代码问题漏洞

Envoy is an Enphase open source gateway program for connecting smart home devices. A code issue vulnerability exists in Envoy, which stems from the OAuth2 filter omitting the Secure attribute when deleting session cookies with the Secure-/Host- prefix, resulting in the browser rejecting the delet...

Linux Distros Unpatched Vulnerability : CVE-2020-1776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case...

Shopify: Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)

Summary: Hi, After logging out of the application, the session associated with the user is not invalidated server-side. An attacker with access to the session cookie prior to logout can reuse the same cookie to re-authenticate, effectively bypassing the logout process and regaining access to the...

CVE-2024-32006

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 SP2. The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authentication...