CVE-2022-36672

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

Hardcoded credentials

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

CVE-2022-36672

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

CVE-2022-36672

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

CVE-2022-33927

Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...

Session fixation

Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...

CVE-2022-33738

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

Malicious code in pagseguro-user-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44f5f966a2d9167d3daa64258da143f975cc8b5bf2c55bbfef711729ca818f79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5197 Malicious code in pagseguro-user-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44f5f966a2d9167d3daa64258da143f975cc8b5bf2c55bbfef711729ca818f79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29243 Improper input-size validation on the user new session name in Nextcloud Server

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage,...

GHSA-92PG-8G57-HQPX Support bundles can include user session IDs in Jenkins Support Core Plugin

Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user basic authentication details only" information user.md. In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support...

Secomea GateManager Cross-Site Scripting Vulnerability (CNVD-2022-38151)

Secomea GateManager is a remote access server product from the Danish company Secomea. security vulnerabilities exist in versions prior to Secomea GateManager 9.7, which can be exploited by attackers to inject javascript or html into a logged-in user session...

Secomea GateManager Cross-Site Request Forgery Vulnerability

Secomea GateManager is a remote access server product from the Danish company Secomea. security vulnerabilities exist in versions prior to Secomea GateManager 9.7, which can be exploited by attackers to issue get requests in a logged-in user session...

CVE-2022-25781

Cross-site Scripting XSS vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session...

Cross site scripting

Cross-site Scripting XSS vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session...

Shopware Code Problem Vulnerability (CNVD-2022-31768)

Shopware is a German Shopware company's open source e-commerce software. A code issue vulnerability exists in Shopware that stems from the fact that in the affected version, a user session is not logged off if the password is reset via password recovery. An attacker could exploit the vulnerabilit...

Shopware 安全漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware, which stems from the fact that the admin-api privilege settings for the sales channel are still available in a normal user session...

CVE-2021-3461

CVE-2021-3461 affects Keycloak and describes a flaw where Keycloak may fail to logout a user session when a logout request originates from an external SAML identity provider and the Principal Type is set to Attribute [Name]. The Connected documents corroborate this exact issue across multiple adv...

CVE-2021-27416 Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management EAM versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of...