4350 matches found
CVE-2024-4183
Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table...
CVE-2024-4183
Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table...
CVE-2024-4183
Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a resource management error vulnerability that stems from an inability to limit the number of active sessions, which can be exploited by an authenticated attacker to crash the...
Cross Site Scripting
github.com/apache/incubator-answer is vulnerable to Cross Site Scripting. The vulnerability is due to improper neutralization of input during web page generation when user modifies their personal website. This allows attackers to inject malicious scripts into the website, which could be executed ...
PT-2024-40005 · Unknown · Uptime Kuma
Name of the Vulnerable Software and Affected Versions: Uptime Kuma affected versions not specified Description: The issue allows access to the platform despite authentication being enabled, as previously logged-in sessions remain valid. The expected behavior is that all previously connected...
[SECURITY] Fedora 38 Update: cockpit-311.2-1.fc38
The Cockpit Web Console enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more...
PT-2024-22883 · Cskefu · Cskefu
Name of the Vulnerable Software and Affected Versions: cskefu version 7 Description: The issue is related to Insufficient Session Expiration, which allows attackers to exploit old sessions for malicious activity. Recommendations: For cskefu version 7, consider implementing proper session expirati...
CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...
PT-2024-2853 · Juniper Networks · Junos
Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on MX Series versions prior to 20.4R3-S9 Juniper Networks Junos OS on MX Series version 21.2 versions prior to 21.2R3-S7 Juniper Networks Junos OS on MX Series version 21.3 versions prior to 21.3R3-S5 Juniper Network...
CVE-2023-34423
Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege...
PT-2024-3845
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential use-after-free UAF vulnerability in the smb2 is network name deleted function in the Linux kernel's SMB client implementation. This vulnerability may...
PT-2024-3842
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential use-after-free UAF in the smb2 is valid oplock break function. This function is part of the SMB client implementation in the Linux kernel. The...
PT-2024-3844
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential use-after-free UAF vulnerability in the is valid oplock break function of the Linux kernel's SMB client implementation. This vulnerability may allow a...
PT-2024-3839
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential use-after-free UAF vulnerability in the cifs stats proc write function of the Linux kernel's SMB client implementation. This vulnerability may allow a...
Session Fixation
@workos-inc/authkit-nextjs vulnerable to Session Fixation. This vulnerability is due to the improper handling of expired sessions within session.ts. This allowing an attacker to reuse an expired session by controlling the x-workos-session header...
[SECURITY] Fedora 40 Update: cockpit-314-1.fc40
The Cockpit Web Console enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more...
AuthKit Next.js Library 安全漏洞
AuthKit Next.js Library is an open source AuthKit library for Next.js for WorkOS. A security vulnerability exists in AuthKit Next.js Library that originated from allowing an attacker to reuse expired sessions by controlling the x-workos-session header...
CVE-2023-42913
CVE-2023-42913 affects macOS Sonoma 14.2 where remote Login sessions may obtain full disk access due to an issue in state management. Apple and Red Hat/NVD references indicate the vulnerability is addressed in macOS Sonoma 14.2 (with fixes applied to Remote Login/session handling). The root cause...