4349 matches found
CVE-2023-50936
IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116...
CVE-2024-0924
creationtimestamp| type| source ---|---|--- 2024-01-26 16:32:26+00:00| seen| https://t.me/ctinow/174305 2024-01-28 10:28:07+00:00| seen| https://t.me/arpsyndicate/3269 2024-02-02 21:16:52+00:00| seen| https://t.me/ctinow/178279 2024-02-19 09:21:45+00:00| seen| https://t.me/ctinow/187525...
CVE-2024-23892
A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/costcentercreate.php, in the costcenterid parameter. Exploitation of this...
CLSA-2024-1706215424 Fix CVE(s): CVE-2023-7104
SECURITY UPDATE: Heap-based buffer overflow in sessionReadRecord function of make alltest Handler - debian/patches/CVE-2023-7104.patch: Fix buffer overread in sessions extension when processing corrupt changeset. - CVE-2023-7104...
The vulnerability of cloud software for creating and using Nextcloud Server’s data storage solution lies in the incorrect expiration time of user sessions, which allows attackers to intercept user sessions.
The vulnerability of cloud software for creating and using Nextcloud Server storage solutions is related to incorrect session duration. Exploiting this vulnerability can allow attackers to intercept user sessions...
CVE-2024-23679 Enonic XP Session Fixation Vulnerability
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes...
Spring Security 6.3 Adds Passive JDK Serialization/Deserialization for Seamless Upgrades
In the early versions of Spring Security, a deliberate decision was made to avoid providing any guarantee of compatibility for serialized classes via JDK serialization between different versions of the project. This decision primarily took into account the context of RMI, with the recommendation...
CVE-2024-21587
An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon bbe-smgd of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory...
Design/Logic Flaw
An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon bbe-smgd of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory...
WEM resets user-specified default printers in disconnected sessions
Users manually select default printers in their WEM-enabled desktop sessions. If they disconnect from the desktop not log off,and an automaticWEM Agent refresh occurs post-disconnect, WEM resets the user-specified default printer for that session. Consequently, when the user reconnects to their...
USN-6566-1: SQLite vulnerabilities
It was discovered that SQLite incorrectly handled certain protection mechanisms when using a CLI script with the --safe option, contrary to expectations. This issue only affected Ubuntu 22.04 LTS. CVE-2022-46908 It was discovered that SQLite incorrectly handled certain memory operations in the...
USN-6566-1 sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled certain protection mechanisms when using a CLI script with the --safe option, contrary to expectations. This issue only affected Ubuntu 22.04 LTS. CVE-2022-46908 It was discovered that SQLite incorrectly handled certain memory operations in the...
CVE-2023-5203
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in...
CVE-2023-5203 WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in...
CVE-2023-5203
CVE-2023-5203 affects WP Sessions Time Monitoring Full Automatic WordPress plugin prior to 1.0.9. The vulnerability stems from not sanitizing the request URL or query parameters before they are used in an SQL query, enabling unauthenticated attackers to extract data via blind time-based SQL injec...
WordPress plugin WP Sessions Time Monitoring Full Automatic Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
OESA-2023-1936 python-flask security update
Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks...
PT-2023-31712 · Unknown · Englesystem
Name of the Vulnerable Software and Affected Versions: Englesystem versions prior to 3.4.1 Description: Englesystem is a shift planning system for chaos events. The system performed insufficient validation of user-supplied data for the DECT number, mobile number, and work-log comment fields. This...
