GHSA-FF72-FF42-C3GW Cross-site Scripting in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for th...

Cross-site Scripting in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for th...

Cross site scripting

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for th...

CVE-2024-21496

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for th...

Palo Alto Networks PAN-OS 9.0.x < 9.0.18 / 9.1.x < 9.1.17 / 10.0.x < 10.0.13 / 10.1.x < 10.1.11 / 10.2.x < 10.2.5 / 11.0.x < 11.0.2 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 9.0.x prior to 9.0.18 or 9.1.x prior to 9.1.17 or 10.0.x prior to 10.0.13 or 10.1.x prior to 10.1.11 or 10.2.x prior to 10.2.5 or 11.0.x prior to 11.0.2. It is, therefore, affected by a vulnerability. - Web sessions in the...

Citrix Director reports ICA Latency value as 0

ICA Latency value shows as 0 while ICA RTT shows correctly in Citrix Director. The issue is seen for ICA sessions coming via NetScaler. The issue may be seen for CVAD version 2112 and above. Get-CimInstance -Namespace root\Citrix\EUEM -Class Citrixeuem PowerShell output shows NetworkLatency as 0...

CVE-2024-0008

Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access...

Design/Logic Flaw

Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access...

CVE-2024-0008

CVE-2024-0008 is the Palo Alto Networks PAN-OS web interface session expiration flaw. Connected sources confirm the issue is an Insufficient Session Expiration in PAN-OS, enabling unauthorized access under certain conditions. Affected component is the PAN-OS management web interface; root cause i...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from the fact that Web sessions in the management interface do not expire under certain circumstances, making it vulnerable to...

SAP Companion 跨站脚本漏洞

SAP Companion is a collaboration server for SAP from SAP Germany. SAP Companion suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive information or hijack user sessions when malicio...

The vulnerability of the VPN function in Cisco Firepower Threat Defense and Cisco Adaptive Security Appliance allows a perpetrator to establish an SSL VPN session with an unauthorized user without the client’s knowledge.

The vulnerability of the VPN function in Cisco Firepower Threat Defense and Cisco Adaptive Security Appliance software relates to bypassing authentication procedures by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to establish an SSL VPN session wit...

CVE-2024-25718

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.getassertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry...

Samly security breach

Samly is used to enable the Plug/Phoenix application via SAML. A security vulnerability exists in Samly versions prior to 1.4.0, which stems from the ability to return expired sessions, which can interfere with access control...

CVE-2024-22313

creationtimestamp| type| source ---|---|--- 2024-02-10 17:26:23+00:00| seen| https://t.me/ctinow/182614 2024-03-03 13:46:58+00:00| seen| https://t.me/ctinow/198724...

PT-2024-21111 · Samly · Samly

Name of the Vulnerable Software and Affected Versions: Samly package versions prior to 1.4.0 for Elixir Description: The issue arises from the Samly.State.Store.get assertion/3 function, which can return an expired session. This interferes with access control because Samly.AuthHandler uses a cach...

CVE-2023-45718

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2023-45718 HCL Sametime is impacted by a failure to invalidate sessions

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

Liferay Portal's account lockout does not invalidate existing user sessions

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked...

GHSA-2MX7-XVFG-FG53 Liferay Portal's account lockout does not invalidate existing user sessions

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked...