tomcat-cluster-session-sync-exp

La herramienta se utiliza únicamente para investigación de seguridad y autoevaluación interna. Está prohibido usarla para lanzar ataques ilegales; el usuario es responsable de las consecuencias. Exploit de sincronización de sesiones del clúster de Tomcat Este es un exploit de deserialización...

CVE-2026-46208

In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop tpmeter sessions during mesh teardown TP meter sessions remain linked on batpriv-tplist after the netlink request has already finished. When the mesh interface is removed, batadvmeshfree currently tears down the...

Siemens APE1808 Improper Restriction of Communication Channel to Intended Endpoints (CVE-2025-22251)

An improper restriction of communication channel to intended endpoints vulnerability CWE-923 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization...

The vulnerability of FortiOS operating systems arises from insufficient restrictions on communication channels for specified endpoints, allowing attackers to implement unauthorized sessions.

The vulnerability of the FortiOS operating systems is related to insufficient restrictions on communication channels for specified endpoints. Exploiting this vulnerability allows a malicious actor to establish unauthorized sessions through created session synchronization packages of the FGSP...

CVE-2025-22251

An improper restriction of communication channel to intended endpoints vulnerability CWE-923 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization...

Firewall session injection in FGSP

...

CVE-2025-22251: Improper Restriction of Communication Channel to Intended Endpoints

An improper restriction of communication channel to intended endpoints vulnerability CWE-923 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization...

CVE-2024-11023

Firebase JavaScript SDK utilizes a "FIREBASEDEFAULTS" cookie to store configuration data, including an "authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "authTokenSyncURL" to point to thei...

CVE-2024-11023

Firebase JavaScript SDK stores configuration data in a FIREBASE_DEFAULTS cookie, including an _authTokenSyncURL field. Connected sources describe that if an attacker can preset or modify this cookie, they can redirect the token sync URL to a malicious server and capture user session data transmit...