Design/Logic Flaw

A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this...

CVE-2023-6760: Undefined Security Weakness

A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this...

PT-2023-31237 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A cross-site scripting XSS issue was found in the article management department. This could potentially allow attackers to inject malicious scripts into websites, affecting user sessions. Recommendations...

How to create a custom log when a user 'logs in' or 'logs out' of the Gateway session.

Demonstrate on Citrix Gateway How to create a custom log when a user 'logs in' or 'logs out' of the Gateway to a Storefront session...

Exploit for SQL Injection in Moodle

CVE-2021-36393 Error-based blind SQL injection with bit-shi...

CVE-2023-44400 Uptime Kuma has Persistentent User Sessions

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the...

PT-2023-29144

Name of the Vulnerable Software and Affected Versions Online Movie Ticket Booking System version 1.0 Description The issue is an authenticated Reflected Cross-Site Scripting vulnerability. This means that an attacker could potentially inject malicious scripts into the system, which would then be...

CVE-2022-3916

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

Anonymous user sessions cannot get a valid RDS User CAL license

With RDS User CALs deployment, anonymous user sessions cannot launch successfully...

How to view all user active and terminated sessions in Gateway & HDX Insight

This Article describes how to view all users active and terminated sessionsin a single-pane visualization in Gateway & HDX Insight...

CVE-2023-41041 User session is still usable after logout in graylog2-server

Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...

The vulnerability of the Citrix Workspace App for Linux operating system, related to access control deficiencies, allows a intruder to gain access to user sessions.

The vulnerability of the Citrix Workspace App for Linux operating system is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to gain access to user sessions...

CVE-2023-38357

Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions...

Session fixation

Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions...

CVE-2023-38357

CVE-2023-38357 affects RWS WorldServer up to version 11.7.3, where session tokens have low entropy and can be enumerated, potentially granting unauthorized access to user sessions. Affected component is the session handling/token generation. The exploitation involves token enumeration leading to ...

PT-2023-25027 · Unknown · Angular-Ui-Notification

Name of the Vulnerable Software and Affected Versions: angular-ui-notification versions 0.1.0 through 0.3.6 Description: The issue is related to a cross-site scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading ...

SAP NetWeaver Enterprise Portal Cross-Site Scripting Vulnerability (CNVD-2023-65184)

SAP NetWeaver Enterprise Portal is a SAP NetWeaver Web front-end component from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive...

PT-2023-22588

Name of the Vulnerable Software and Affected Versions mkucej/i-librarian-free versions prior to 5.10.4 Description The issue is related to Cross-site Scripting XSS - Stored. This means that an attacker can inject malicious scripts into the application, which are then stored and executed by the...

Design/Logic Flaw

An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS commands, injecting cleartext commands into an encrypted user session. This can lead to credential disclosure...

PT-2023-21189

Name of the Vulnerable Software and Affected Versions thorsten/phpmyfaq versions prior to 3.2.0-beta Description The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application accepts user input without proper validation and stores it, allowing an attacker to inject...