Session fixation

An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-42545

CVE-2021-42545 : The TopEase Platform from Business-DNA Solutions GmbH is affected up to version 7.1.27 due to an insufficient session expiration issue that enables a remote attacker to reuse, spoof, or steal other user and admin sessions. The available documents identify the vulnerability as a s...

Business-Dna Solution GmbH TopEase 代码问题漏洞

Business-Dna Solution GmbH TopEase is a "Transformational Risk" solution from Business-Dna Solution GmbH, Switzerland. It is used to manage complex projects and initiatives comprehensively, simply, quickly and securely. A code issue vulnerability exists in Business-Dna Solution GmbH TopEase, whic...

IBM QRadar SIEM 跨站脚本漏洞

IBM QRadar SIEM is a solution from IBM America that leverages security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, etc. A cross-site...

CMSimple 5.4 Local File Inclusion / Remote Code Execution

Exploit Title: CMSimple 5.4 - Local file inclusion LFI to Remote code execution RCE Authenticated Date: 11/15/2021 Exploit Author: S1lv3r Vendor Homepage: https://www.cmsimple.org/en/ Software Link: https://www.cmsimple.org/en/ Version: CMSimple 5.4 Tested on: CMSimple 5.4 writeup:...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

Open-xchange OX App Suite Information Disclosure Vulnerability (CNVD-2021-90763)

Open-xchange OX App Suite is a Web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. An information disclosure vulnerability exists in Open-xchange OX App Suite, which could be...

Open-xchange OX App Suite 授权问题漏洞

Open-xchange OX App Suite is a Web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. An information disclosure vulnerability exists in Open-xchange OX App Suite, which could be...

Darwin Factor 代码问题漏洞

Darwin Factor is a free and open source next-generation TypeScript framework from Darwin, Inc. It is used to create blogs, login pages, and JamStack applications. Darwin Factor has a security vulnerability that stems from incorrectly invalidating a user's session even after the user logs out of t...

GHSA-9J9M-8WJC-FF96 Apostrophe CMS Insufficient Session Expiration vulnerability

Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. As a mitigation for older releases the user account in question can be archived 3.x or moved to...

Apostrophe licensing issue vulnerability

Apostrophe is a full-featured open source Cms built with Node.js by Apostrophe, Inc. designed to empower organizations by combining contextual editing and headless architecture in a full-stack Js environment.Apostrophe CMS is vulnerable to an authorization issue in versions 2.63.0 through 3.3.1,...

CVE-2021-25979

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

Session fixation

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

Barrier 资源管理错误漏洞

Barrier is a software that mimics the functionality of the Kvm switcher. A security vulnerability exists in Barrier, which stems from the fact that prior to 2.3.4 Barrier sent Hello messages for each TCP session simultaneously, which could be used by an attacker to cause a segmentation error in t...

CVE-2021-29673

IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199482...

Security Bulletin: Vulnerability in SSLv3 affects IBM Packaging Utility (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Packaging Utility Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follo...

CVE-2021-0702

In RevertActiveSessions of apexd.cpp, there is a possible way to share the wrong file due to an unintentional MediaStore downgrade. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CamaleonCMS 代码问题漏洞

CamaleonCMS is an advanced RubyonRails-based dynamic content management system CMS from the CamaleonCMS team. A security vulnerability exists in Camaleon CMS versions 0.1.7 through 2.6.0, which stems from an issue with the software's password change control that does not terminate a user's active...

jenkins: session fixation vulnerability

Session fixation vulnerability was found in Jenkins. The existing session on login process are not invalidated and this allows an attacker to gain potentially additional access on Jenkins by using social engineering attack techniques on a target user...

CVE-2021-0297

A vulnerability in the processing of TCP MD5 authentication in Juniper Networks Junos OS Evolved may allow a BGP or LDP session configured with MD5 authentication to succeed, even if the peer does not have TCP MD5 authentication enabled. This could lead to untrusted or unauthorized sessions being...