fortinet-cve-2024-50562

Fortinet SSL-VPN セッション再利用の脆弱性 CVE-2024-50562 プロフェッショナル向け・許可を得た場合のみ使用するスキャナー 。FortiGate がログアウト後にセッション Cookie を無効化するかどうかを検証します。 陽性の結果は CVE-2024-50562 、すなわち セッション期限切れの不備 CWE-613 を確認するもので、攻撃者が盗んだ Cookie を再生し、ユーザーが明示的にログアウトした後でも再ログインできることを示します。 公式アドバイザリ: https://fortiguard.com/psirt/FG-IR-24-339 0 |...

CVE-2024-41958-PoC

CVE-2024-41958-PoC これは CVE-2024-41958 の小さな概念実証です。 管理パネルでTFA認証をバイパスすることが可能です。 影響を受けるバージョン: 2024-07 このCVEを機能させるために必要な前提条件: TFAなしのアカウントのPasswordとusername。 TFAが有効なアカウントのPasswordとusername。 2024-07より前のMailcowバージョン。 PoCの使用方法: 1. 依存関係をインストールします root@kitploit: pip install -r requirements.txt 2...

CVE-2026-41940-Detection

CVE-2026-41940 检测 针对 cPanel/WHM 身份验证绕过漏洞（CVE-2026-41940）的检测规则和日志架构，由 Unfold Security 提供。 博客文章： cPanel 漏洞利用 — CVE-2026-41940 目录结构 root@kitploit: ├── cpanelcve202641940malget.yml SIGMA 规则 — 检测 CRLF 注入请求 ├── cpanelsessionmalauthorization.yml SIGMA 规则 — 检测未经先前登录的会话使用 ├── Schemas/ │ ├── Microsoft...

CVE-2025-23419

🔐 TLS Session Reuse Exploit Tester $ BY XIT TLSセッション再利用の脆弱性をテストするためのPythonベースのツールです。設定ミスのあるサーバーで認証バイパスを引き起こす可能性があります。 ⚠️ 免責事項 このツールは教育目的および許可を得たセキュリティテスト専用 です。 適切な許可なくシステムで使用しないでください。 📌 説明 このスクリプトは、TLSセッション再利用シナリオのシミュレーションを試みます： 1. クライアント証明書認証を要求する サーバーに接続します 2. TLSセッションを確立します 3...

Astra Linux – Vulnerability in liblivemedia

Live555 before 2019.08.16 has a Use-After-Free issue, as GenericMediaServer::createNewClientSessionWithId can generate the same client session ID consecutively. This issue is handled improperly by the MPEG1or2 and Matroska file demultiplexors...

CVE-2026-46355

BigBlueButton prior to 3.0.23 exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through a routable controller action in ApiController.groovy rather than a private helper. An authenticated requester who could supply the existingUserID of an active participant was able to reuse that pa...

BIT-NODE-MIN-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

BIT-NODE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-70606

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

EUVD-2026-53445

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

CVE-2026-14465

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52654

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465

CVE-2026-14465 : Insufficient session expiration allowing session ID reuse (session fixation) in Bilin Software’s HUMANIST Digital Human Resources. Affects versions from 26.0 up to, but not including, 26.1. Impact: potential for session replay with high confidentiality risk; no impact to integrit...

CVE-2026-67334

CVE-2026-67334 affects better-auth versions before 1.6.11. When secondaryStorage is configured and storeSessionInDatabase is false, deleting users via admin, anonymous, or SCIM endpoints fails to delete cached sessions, allowing attackers to reuse deleted user session tokens for up to seven days ...

SUSE CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...

ALPINE-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

UBUNTU-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...