1939 matches found
The vulnerability in the implementation of TLS and SSL protocols for the Apple Music app on the Android operating system allows a hacker to intercept the user’s session.
The vulnerability of the TLS and SSL protocols implemented by Apple Music for the Android operating system is related to improper session management. Exploiting this vulnerability can allow a malicious actor to intercept a user’s session...
CVE-2024-29837 Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in...
CVE-2024-29837
In Evolution Controller, the Web interface vulnerability CVE-2024-29837 affects Versions 2.04.560.31.03.2024 and earlier. The root cause is poor session management, enabling an unauthenticated attacker to access administrator functionality if any other user is already signed in. This is evidenced...
CVE-2024-29837 Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in...
PT-2024-23074
Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller uses poor session management, allowing an unauthenticated attacker to access administrator functionality if any other user is...
DirectCyber Evolution Controller 安全漏洞
DirectCyber Evolution Controller is an access control controller software from DirectCyber, Inc. that is used for physical access to the facility by the controller. A security vulnerability exists in DirectCyber Evolution Controller version 2.04.560.31.03.2024 and prior versions, which stems from...
IBM UrbanCode Deploy 代码问题漏洞
IBM UrbanCode Deploy UCD is a set of application automation deployment tools from International Business Machines IBM. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different...
slim-pack (>=0.0.1, <=0.0.5) potentially affected by CVE-2024-31999 via @fastify/secure-session (7.1.0)
@fastify/secure-session NPM version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/secure-session and may be impacted: - slim-pack =0.0.1, =0.0.5 Source cves: CVE-2024-31999 Source advisory: OSV:GHSA-9WWP-Q7WQ-JX35...
Insufficient Session Expiration
Shopware is vulnerable to Insufficient Session Expiration. The vulnerability is caused due to improper session management within LogoutRoute.php, specifically in the handling of authenticated logout requests to the /store-api/account/logout POST endpoint. This leads to the cart being cleared...
CVE-2024-29901
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the x-workos-session header. The vulnerability is patched in v0.4.2...
CVE-2024-29901
CVE-2024-29901 concerns the AuthKit Next.js library. The issue arises from improper handling of expired sessions, allowing an attacker to reuse an expired session by controlling the x-workos-session header. Affected component: workOS/AuthKit Next.js integration (authkit-nextjs). Impact is describ...
FusionPBX Session Fixation
Vulnerability Name - Application is Vulnerable to Session Fixation Vulnerable URL: www.fusionpbx.com Overview of the Vulnerability Session fixation is a security vulnerability that occurs when an attacker sets or fixes a user's session identifier, manipulating the authentication process. Typicall...
The vulnerability of the VMware Enhanced Authentication Plug-in’s authentication module, related to improper session management, allows attackers to escalate their privileges.
The vulnerability of the VMware Enhanced Authentication Plug-in EAP is related to improper session management. Exploiting this vulnerability can allow attackers to gain increased privileges...
CVE-2024-28114
Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager =1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been...
Cross site scripting
Peering Manager is a BGP session management tool. Affected versions of Peering Manager are subject to a potential stored Cross-Site Scripting XSS attack in the name attribute of AS or Platform. The XSS triggers on a routers detail page. Adversaries are able to execute arbitrary JavaScript code wi...
Design/Logic Flaw
Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager =1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been...
CVE-2024-28114 Remote Code Execution using Server Side Template Injection in Peering Manager
Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager =1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been...
CVE-2024-28113 Open redirection using the return_url parameter in Peering Manager
Peering Manager is a BGP session management tool. In Peering Manager =1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a result users can be redirected to an unexpected location. This issue has been addressed in version 1.8.3. Users are advised to upgrade. Ther...
CVE-2024-28113 Open redirection using the return_url parameter in Peering Manager
Peering Manager is a BGP session management tool. In Peering Manager =1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a result users can be redirected to an unexpected location. This issue has been addressed in version 1.8.3. Users are advised to upgrade. Ther...