CVE-2020-17526

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...

CVE-2020-17526

Apache Airflow Webserver prior to version 1.10.14 with the default [webserver] secret_key allows an authenticated user on one site to access an unauthorized Webserver session on another site via session validation bypass. Affected component is the Webserver authentication mechanism; root cause is...

VestaCP 0.9.8-26 - 'backup' Information Disclosure

Exploit Title: VestaCP 0.9.8-26 - 'backup' Information Disclosure Date: 2020-11-25 Exploit Author: Vulnerability-Lab Vendor Homepage: https://vestacp.com/ Software Link: https://vestacp.com/install/ Version: 0.9.8-26 Document Title: =============== VestaCP v0.9.8-26 - Insufficient Session...

VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation

Exploit Title: VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation Date: 2020-11-26 Exploit Author: Vulnerability-Lab Vendor Homepage: https://vestacp.com/ Software Link: https://vestacp.com/install/ Version: 0.9.8-26 Document Title: =============== VestaCP v0.9.8-26 - LoginAs Token...

VestaCP 0.9.8-26 Session Validation

Document Title: =============== VestaCP v0.9.8-26 - Session Validation Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2238 Release Date: ============= 2020-11-25 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2020-4696

CVE-2020-4696 affects IBM Cloud Pak for Security (CP4S) version 1.3.0.1. The root cause is that the session is not invalidated after logout, which could allow an authenticated user to obtain sensitive information from the previous session. Affected software: CP4S 1.3.0.1. Impact described in sour...

VestaCP v0.9.8-26 - Session Validation Web Vulnerability

Document Title: =============== VestaCP v0.9.8-26 - Session Validation Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2238 Release Date: ============= 2020-11-25 Vulnerability Laboratory ID VL-ID: ====================================...

TSMManager Collector Information Disclosure Vulnerability

Tsmmanager TSMManager Collector is a software that enables monitoring, management, operation, and control of Distributed Storage Managers, Tivoli Storage Managers, and Disk Storage Managers from TSMManager Tsmmanager, USA. An information disclosure vulnerability exists in JamoDat TSMManager...

Aviatrix Systems Controller 加密问题漏洞

Aviatrix Controller is a centralized control panel for orchestrating and managing various network and connectivity solutions. An improper access control vulnerability exists in Aviatrix Controller versions prior to R6.0.2483. The vulnerability stems from the fact that multiple executables...

PT-2020-14328 · Parse · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions 4.3.0 Description: The issue allows clients with expired sessions to still receive subscription objects because Parse Server broadcasts events to all clients without checking if the session token is valid. It is not...

CVE-2020-4494

IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 Linux and Windows, 8.1.9.0 trough 8.1.9.1 AIX and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 Linux, 8.1.9.0 through 8.1.9.1 AIX web user interfaces could allow an attacker to bypass authentication due to improper session...

Authentication flaw

IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 Linux and Windows, 8.1.9.0 trough 8.1.9.1 AIX and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 Linux, 8.1.9.0 through 8.1.9.1 AIX web user interfaces could allow an attacker to bypass authentication due to improper session...

CVE-2020-4494

CVE-2020-4494 affects IBM Spectrum Protect Client (Linux/Windows) versions 8.1.7.0–8.1.9.1 and Spectrum Protect for Space Management (Linux) 8.1.7.0–8.1.9.1, with web UIs that could bypass authentication due to improper session validation, potentially granting access to unauthorized resources. IB...

QRadar Community Edition 7.3.1.6 Path Traversal Vulnerability

QRadar Community Edition version 7.3.1.6 has a path traversal that exists in the session validation functionality. In particular, the vulnerability is present in the part that handles session tokens UUIDs. QRadar fails to validate if the user-supplied token is in the correct format. Using path...

SMACom 1.2.0 Insecure Transit / Password Disclosure

Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-16 Vulnerability Laboratory ID VL-ID: ====================================...

SMACom v1.2.0 - Insecure Session Validation Vulnerability

Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-15 Vulnerability Laboratory ID VL-ID: ====================================...

Security Bulletin: A vulnerability in IBM Websphere Application Server affects the IBM Performance Management product (CVE-2019-4304)

Summary A vulnerability in IBM Websphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM Performance Management has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Tivoli Netcool Impact (CVE-2019-4304)

Summary IBM WebSphere Application Server Liberty is shipped as a component of IBM Tivoli Netcool Impact. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION:...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2019-4304)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability. CVE-2019-4304 Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Summary Security vulnerabilities in WebSphere Application Server Liberty, such as spoofing, obtaining sensitive information, and bypassing security restrictions, affect IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Prote...