CVE-2021-26095

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its...

CVE-2021-26095

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its...

CVE-2021-26037

CVE-2021-26037 affects Joomla! core versions 2.5.0 through 3.9.27. The root cause is that CMS functions did not properly terminate existing user sessions when a user’s password was changed or the user was blocked. This behavioral gap can allow an attacker to retain or regain a session that should...

FortiMail - Improper cryptographic operations in cookie encryption potentially prone to forgery

The combination of various cryptographic issues in the session management of FortiMail, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges...

CVE-2021-21671

CVE-2021-21671 affects Jenkins 2.299 and earlier (including LTS 2.289.1 and earlier), where the system does not invalidate the previous session on login, enabling session fixation. Exploitation could allow a remote attacker with social engineering to gain administrator access. Remediation: upgrad...

CVE-2021-29481

CVE-2021-29481 affects Ratpack versions before 1.9.0, where the default client-side session configuration stores data in cookies in an unencrypted but signed form. This can allow an attacker with cookie access to read sensitive information if such data is stored in the session and the cookie is l...

Eclipse Jetty Session Vulnerability (GHSA-m6cp-vxjx-65j6) - Linux

Eclipse Jetty is prone to a vulnerability in the session management. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Eclipse Jetty Session Vulnerability (GHSA-m6cp-vxjx-65j6) - Windows

Eclipse Jetty is prone to a vulnerability in the session management. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-32541

The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the user to be unable to access the services...

CVE-2021-32541

The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the user to be unable to access the services...

Authentication flaw

The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the user to be unable to access the services...

CVE-2021-32541

CVE-2021-32541: A vulnerability in the CTS Web transaction system’s authentication and session management allows remote unauthenticated actors to flood with valid usernames and force logged-in users to log out, potentially denying access to services. The issue is tied to an incorrect implementati...

CVE-2021-32541 SysJust CTS Web - Broken Access Control

The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the user to be unable to access the services...

嘉实资讯 CTS Web transaction system 授权问题漏洞

CTS Web transaction system is a CTS Web transaction system from Cascade Information Technology, Taiwan. The CTS Web transaction system suffers from an authorization issue vulnerability that stems from an incorrect implementation of the CTS Web transaction system related to authentication and...

Insecure Session Management

github.com/ory/fosite uses insecure session management. The vulnerability exists as it fails to validate the uniqueness of this jti value in privatekeyjwt client authentication method, allowing an attacker to send the same token request twice with the same jti assertion to get two access tokens...

Insecure Session Management

github.com/nats-io/nats-server uses an insecure session management. Expired credentials are not properly handled,...

Insecure Session Management

keycloak uses an insecure session management. The application may fail to invalidate user session if the logout request comes from external SAML identity provider that is set up to identify principal via attributes rather than Subject Name ID...

CVE-2021-27463

A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications utilize persistent cookies where the session cookie attribute is not properly invalidated, allowing an attacker to intercept the cookies and gain access to sensitive...

Weak Session Management Detected

A web session is a set of HTTP transactions issued by a user within a given time frame. Web applications use sessions to retain information about each user, keep track of their activity or define proper access rights and permissions. Each session has an identifier token or ID defined by the...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

gofor 一款集漏洞探测、攻击，Session会话，蜜罐识别等功能于一身的软件，基于go-micro微服务框架并对外提供统一HTTP API网关接口服务 HTTP API Gateway shell ./api-srv Service InstallOptional Exploit ./srv-exploit Webshell webshell ./srv-webshell Example ThinkPHP5.0.20 RCE 攻击例子 shell curl -H "Content-Type:application/json;charset=utf-8" -X POST -d...