482 matches found
Lightdash v0.1024.6 - Server-Side Request Forgery
Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...
CVE-2026-115519
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not...
Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc Multiple Vulnerabilities (crlsa-2019_1529)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20191529 advisory. tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up CVE-2018-8037 tomcat: Insecure defaults in CORS filter enable...
CVE-2025-62342
HCL IntelliOps Event Management IEM is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion...
CVE-2025-62342
HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability where user sessions may not be fully terminated after logout or deletion, due to improper session handling. The vulnerability carries a CVSS 3.1 score of 6.4 (Medium) with high impacts to confidentiality and ava...
CVE-2025-62342 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management IEM is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion...
PT-2026-82504
Name of the Vulnerable Software and Affected Versions HCL IntelliOps Event Management IEM affected versions not specified Description Improper handling of user sessions may prevent sessions from being fully terminated after a logout or deletion process occurs. Recommendations At the moment, there...
SUSE CVE-2026-33544
Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations GenericOAuthService, GithubOAuthService, GoogleOAuthService store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent...
Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting Detection
A reflected cross-site scripting XSS vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript...
UniGUI Server Monitor Panel - Exposure Detection
Detects exposed UniGUI Server Monitor Panels which could reveal sensitive server statistics, users sessions, licensing information and others data. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed UniGUI Server Monitor Panels which could reveal sensitive server statistics, users...
CVE-2026-13332 Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...
CVE-2026-13332
The Masteriyo LMS WordPress plugin versions prior to 2.3.1 is vulnerable to an unauthenticated arbitrary user session termination (Denial of Service). The root cause is an improper authorization check on an unauthenticated AJAX action designed to clear user sessions. This flaw allows an unauthent...
CVE-2026-49229 Actual: Disabled OpenID users keep access through existing session tokens
Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row...
PT-2026-67314
Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 @better-auth/scim versions prior to 1.6.11 Description When secondaryStorage is configured and storeSessionInDatabase is set to false, certain user-deletion processes fail to remove cached sessions. This...
CVE-2026-56774 Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session...
WS-2021-0042
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...
Cross-site Scripting (XSS)
Overview bagisto/bagisto is a hand tailored E-Commerce framework designed on some opensource technologies such as Laravel a PHP framework, Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Custom Scripts interface. An...
Apache Airflow Information Disclosure
The vulnerability of the Apache Airflow network software is related to the disclosure of information in the error data area. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to user sessions...
USN-8144-1 undertow vulnerability
It was discovered that Undertow incorrectly validated the Host header in incoming HTTP requests. A remote attacker could possibly use this issue to gain unintended access to user sessions...
