Session Fixation

Umbraco is vulnerable to Session Fixation. The vulnerability is due to a session timeout discrepancy where the Backoffice logout page displays a session timeout message before the server session expires, leading users to believe they are logged out about 30 seconds early. It allows an attacker to...

PT-2024-21235 · Dell · Idrac9

Name of the Vulnerable Software and Affected Versions: iDRAC9 versions prior to 7.00.00.172 for 14th Generation iDRAC9 versions prior to 7.10.50.00 for 15th and 16th Generations Description: The issue is related to a session hijacking vulnerability in IPMI, which could be exploited by a remote...

PT-2024-19499 · Zenml · Zenml

Name of the Vulnerable Software and Affected Versions: zenml-io/zenml affected versions not specified Description: A session fixation issue exists in the zenml-io/zenml application. The problem arises because JWT tokens used for user authentication are not invalidated upon logout. This allows an...

Session Fixation

contao/core-bundle is vulnerable to Session Fixation. The vulnerability is due to a flaw in the personal data and password lost modules. allowing compromised accounts to retain access even after password changes...

TOTOLINK A8000RU has an unspecified vulnerability

TOTOLINK A8000RU is a wireless router from China's Gion Electronics TOTOLINK. An unspecified vulnerability exists in the TOTOLINK A8000RU, which can be exploited by an attacker to log into the administrator account by providing a specially crafted session cookie...

CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-23885 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/countrymodify.php, in the countryid parameter. Exploitation of this vulnerability...

CVE-2024-23864 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/countrylist.php, in the description parameter. Exploitation of this vulnerability...

CVE-2024-23862 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/grndisplay.php, in the grnno parameter. Exploitation of this vulnerability could...

CVE-2024-23857 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/grnlinecreate.php, in the batchno parameter. Exploitation of this vulnerability...

CVE-2024-23856 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/itemlist.php, in the description parameter. Exploitation of this vulnerability cou...

Insecure Session Management

thorsten/phpmyfaq is vulnerable to Insecure Session Management. The vulnerability exists because the sessions are not securely handled which allows an attacker to perform unauthorized actions...

PT-2023-32384 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpmyfaq versions prior to 3.2.2 Description: The issue is related to insufficient session expiration. Recommendations: For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue...

MGASA-2023-0276 Updated xrdp packages fix security vulnerability

In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in session restrictions such as max concurrent sessions per user by PAM ex...

CVE-2023-40732

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...

PT-2023-6794

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.9.23 Description The issue is related to the improper handling of session establishment errors in xrdp, allowing bypassing of OS-level session restrictions. The auth start session function can return a non-zero value o...

PT-2023-6852 · Unknown · Pt-G503 Series

Name of the Vulnerable Software and Affected Versions: PT-G503 Series versions prior to v5.2 Description: A vulnerability has been identified where the session cookies attribute is not set properly in the affected application, potentially exposing user session data to unauthorized access and...

PT-2023-26186 · Cal.Com · Cal.Com

Name of the Vulnerable Software and Affected Versions: Cal.com affected versions not specified Description: A vulnerability in Cal.com open-source scheduling software allows active sessions associated with an account to remain active even after enabling 2FA. When 2FA is activated on a Cal.com...

CVE-2023-30861 Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

IO FinNet tss-lib vulnerable to replay attacks involving proofs

An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session...