fortinet-cve-2024-50562

Уязвимость повторного использования сессии Fortinet SSL-VPN CVE-2024-50562 Профессиональный сканер с разрешением , который проверяет, аннулирует ли FortiGate файлы cookie сессии после выхода из системы. Положительный результат подтверждает CVE-2024-50562 — ошибку Недостаточного срока действия...

CVE-2024-41958-PoC

CVE-2024-41958-PoC Это небольшая концептуальная демонстрация для CVE-2024-41958. Возможен обход аутентификации TFA в панели администратора. Затронутые версии: 2024-07 Необходимые предварительные условия для работы CVE: Пароль и имя пользователя для учетной записи без TFA. Пароль и имя пользовател...

CVE-2026-41940-Detection

CVE-2026-41940 탐지 cPanel/WHM 인증 우회CVE-2026-41940에 대한 탐지 규칙 및 로그 스키마 — Unfold Security 제공. 블로그 게시물: cPanel 익스플로잇 — CVE-2026-41940 구조 root@kitploit: ├── cpanelcve202641940malget.yml SIGMA 규칙 — CRLF 주입 요청 탐지 ├── cpanelsessionmalauthorization.yml SIGMA 규칙 — 사전 로그인 없이 세션 사용 탐지 ├── Schemas/ │ ├──...

CVE-2025-23419

🔐 TLS Session Reuse Exploit Tester $ BY XIT TLSセッション再利用の脆弱性をテストするためのPythonベースのツールです。設定ミスのあるサーバーで認証バイパスを引き起こす可能性があります。 ⚠️ 免責事項 このツールは教育目的および許可を得たセキュリティテスト専用 です。 適切な許可なくシステムで使用しないでください。 📌 説明 このスクリプトは、TLSセッション再利用シナリオのシミュレーションを試みます： 1. クライアント証明書認証を要求する サーバーに接続します 2. TLSセッションを確立します 3...

Astra Linux – Vulnerability in liblivemedia

Live555 before 2019.08.16 has a Use-After-Free issue, as GenericMediaServer::createNewClientSessionWithId can generate the same client session ID consecutively. This issue is handled improperly by the MPEG1or2 and Matroska file demultiplexors...

CVE-2026-46355

BigBlueButton prior to 3.0.23 exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through a routable controller action in ApiController.groovy rather than a private helper. An authenticated requester who could supply the existingUserID of an active participant was able to reuse that pa...

BIT-NODE-MIN-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

BIT-NODE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-70606

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

EUVD-2026-53445

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

CVE-2026-14465

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52654

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465

CVE-2026-14465 : Insufficient session expiration allowing session ID reuse (session fixation) in Bilin Software’s HUMANIST Digital Human Resources. Affects versions from 26.0 up to, but not including, 26.1. Impact: potential for session replay with high confidentiality risk; no impact to integrit...

CVE-2026-67334

CVE-2026-67334 affects better-auth versions before 1.6.11. When secondaryStorage is configured and storeSessionInDatabase is false, deleting users via admin, anonymous, or SCIM endpoints fails to delete cached sessions, allowing attackers to reuse deleted user session tokens for up to seven days ...

SUSE CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...

ALPINE-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

UBUNTU-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...