CVE-2021-25966

CVE-2021-25966 affects Orchard Core CMS: versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change, allowing a user who was already logged in to retain access even after the password is changed. The connected sources provide explicit details on aff...

CVE-2021-25966 Orchard Core CMS - Improper Session Termination after Password Change

In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even aft...

OrchardCMS 代码问题漏洞

OrchardCMS is an open source modular and multi-tenant application framework built using ASP.NET Core and the Content Management System CMS built on top of it. A code issue exists in OrchardCMS that originates in the "Orchard core CMS" application, versions 1.0.0-beta1-3383 through 1.0.0, which is...

Man-in-the-middle (MITM)

nbdkit:sid is vulnerable to man-in-the-middle. A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBDOPTSTRUCTUREDREPLY before proxying everything else a client sends to the...

UBUNTU-CVE-2021-37156

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...

PT-2021-16930 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.27 Description: An issue was discovered in the CMS functions where existing user sessions were not properly terminated when a user's password was changed or the user was blocked. Recommendations: For Joomla!...

The vulnerability of the Magento Commerce software platform for developing and managing online stores lies in the lack of automatic termination of all sessions after changing passwords. This allows attackers to gain unauthorized access to limited resources.

The vulnerability of the Magento Commerce software development and management platform lies in the lack of automatic termination of all sessions after the password is changed. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to limited resources...

CVE-2020-25241

A vulnerability has been identified in SIMATIC MV400 family All Versions V7.0.6. The underlying TCP stack of the affected products does not correctly validate the sequence number for incoming TCP RST packages. An attacker could exploit this to terminate arbitrary TCP sessions...

mymbCONNECT24 安全漏洞

Mb Connect Line MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE Mb Connect Line, Germany. A security vulnerability exists in mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2, which stems from the improper...

CVE-2021-27351

The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session...

PT-2021-2300 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to the lack of automatic termination of all sessions after a password change, which could allow a...

CVE-2020-1666 Junos OS Evolved: 'console log-out-on-disconnect' fails to terminate session on console cable disconnection

The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactiv...

The vulnerability of the TrueConf Server software lies in the lack of a mechanism to terminate the user’s access session, allowing attackers to intercept the user’s session.

The vulnerability of the TrueConf Server software is related to the absence of a mechanism to terminate the user’s access session. Exploiting this vulnerability could allow a malicious actor to intercept the user’s session...

The vulnerability of the Red Hat IPA domain controller, related to the lack of automatic termination of all sessions after password changes, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Red Hat IPA domain controller is related to the absence of automatic termination of all sessions after the password is changed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Junos OS: Established BGP Session Termination Vulnerability (JSA10996)

The version of Junos OS installed on the remote host is 12.3, 12.3X48, 14.1X53 or prior to 15.1R7-S5, 15.1F6-S13, 15.1X49-D180, 15.1X53-D238, 15.1X53-D497, 15.1X53-D592, 16.1R7-S7, 17.1R2-S12, 17.2R2-S7, 17.2X75-D102, 17.3R2-S5, 17.4R1-S8, 18.1R2-S4, or 18.2X75-D20. It is, therefore, affected by ...

CVE-2020-1613

A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon receiving a specific BGP FlowSpec advertisement. The BGP NOTIFICATION message that terminates an established BGP session is sent toward the peer device that...

CVE-2020-1613

The CVE describes a vulnerability in Juniper Junos OS BGP FlowSpec handling where receiving a specific FlowSpec advertisement can terminate an established BGP session. Affected products include Junos OS versions listed in the CVE (e.g., 12.3, 12.3X48, 14.1X53, 15.1R7-S5 and earlier, 16.1R7-S7 and...

CVE-2020-1613 Junos OS: BGP session termination upon receipt of specific BGP FlowSpec advertisement.

A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon receiving a specific BGP FlowSpec advertisement. The BGP NOTIFICATION message that terminates an established BGP session is sent toward the peer device that...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22188)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue ISIQ that stems from the program failin...

CVE-2020-5224

In Django User Sessions django-user-sessions before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the...