407 matches found
CVE-2025-24502
CVE-2025-24502 describes an improper session validation that allows an unauthenticated attacker to trigger request notifications in the context of the wrong user by spoofing the client IP address. Connected sources identify Broadcom Symantec Privileged Access Management (PAM) as affected, with no...
CVE-2025-24502
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address...
PT-2025-5374 · Broadcom · Symantec Privileged Access Management
Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP addres...
CVE-2024-38315
CVE-2024-38315 – IBM Aspera Shares session handling issue : IBM Aspera Shares versions 1.0.0 to 1.10.0 PL2 do not invalidate a user session after a password reset, which could allow an authenticated user to impersonate another user. Root cause: lack of session invalidation post-password reset. Af...
Zend-Session session validation vulnerability
Zend\Session session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails where $this-manager is an instance of Zend\Session\SessionManager: $this -manager -getValidatorChain -attach'session.validate', arraynew RemoteAddr, 'isValid...
GHSA-96C6-M98X-HXJX Zend-Session session validation vulnerability
Zend\Session session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails where $this-manager is an instance of Zend\Session\SessionManager: $this -manager -getValidatorChain -attach'session.validate', arraynew RemoteAddr, 'isValid...
Zendframework session validation vulnerability
Zend\Session session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails where $this-manager is an instance of Zend\Session\SessionManager: $this -manager -getValidatorChain -attach'session.validate', arraynew RemoteAddr, 'isValid...
PT-2024-40289
Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue concerns TYPO3's built-in record registration functionality, also known as the basic shopping cart, which uses recs URL parameters. This functionality is vulnerable to denial of...
SUSE CVE-2024-5148
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and...
CVE-2024-24539
FusionPBX before 5.2.0 does not validate a session...
FusionPBX Security Vulnerabilities
FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conferencing server and voice application server. A security vulnerability exists in FusionPBX versions prior to 5.2.0 that stems from the...
CVE-2024-24539
The communications platform FusionPBX is vulnerable in versions prior to 5.2.0 due to a lack of session validation . This security weakness allows for potential unauthorized access or actions because the application fails to properly verify active sessions. To remediate this issue, users are reco...
CVE-2024-24539
FusionPBX before 5.2.0 does not validate a session...
CVE-2024-24539
FusionPBX before 5.2.0 does not validate a session...
CVE-2024-24539: Undefined Security Weakness
FusionPBX before 5.2.0 does not validate a session...
CVE-2024-24539
FusionPBX before 5.2.0 does not validate a session...
PT-2024-20437 · Fusionpbx · Fusionpbx
Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 5.2.0 Description: The issue is related to a lack of session validation. Recommendations: For versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue...
BIT-AIRFLOW-2020-17526
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...
SUSE CVE-2023-52442
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request smb2getmsg in smb2getksmbdtcon and smb2checkusersession will always return the first request smb2 header in a compound request. if SMB2TREECONNECTHE is the first command ...
CVE-2023-52442
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request smb2getmsg in smb2getksmbdtcon and smb2checkusersession will always return the first request smb2 header in a compound request. if SMB2TREECONNECTHE is the first command ...