Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,183 results · page 26 of 64
Feb 11, 2024In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because SamlCVE-2024-25718 · Other software · samly · reported by MITRECritical 9.8
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.
- Product
- elixr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024Sametime is impacted by a failure to invalidate sessions.CVE-2023-45718 · Other software · HCL Software · reported by psirt@hcl.comLow 3.9
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.
- Product
- HCL Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 8, 2024IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonCVE-2023-45187 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.
- Product
- Engineering Lifecycle Optimization - Publishing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 8, 2024Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc.CVE-2023-6519 · Other software · Mia Technology Inc. · reported by iletisim@usom.gov.trHigh 7.5
Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.
- Product
- MİA-MED
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 5, 2024Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering.CVE-2024-1052 · Other software · HashiCorp · reported by security@hashicorp.comHigh 8
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
- Product
- Boundary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Feb 3, 2024curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed.CVE-2024-0853 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 5.3
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authenticaCVE-2024-1143 · Other software · LINE Corporation · reported by dl_cve@linecorp.comCritical 9.3
Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.
- Product
- Central Dogma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings.CVE-2023-50328 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110.
- Product
- PowerSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 1, 2024IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.CVE-2023-50936 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116.
- Product
- PowerSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 30, 2024In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or CVE-2023-46231 · Other software · Splunk · reported by prodsec@splunk.comMedium 6.8
In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on.
- Product
- Splunk Add-on Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comadvisory.splunk.com
Jan 26, 2024Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor aCVE-2023-6482 · Other software · Synaptics · reported by PSIRT@synaptics.comMedium 5.2
Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may allow an attacker, who has physical access to the sensor, to enroll a fingerprint into the template database.
- Product
- Synaptics Fingerprint Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynaptics.comsynaptics.com
Jan 24, 2024An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component.CVE-2023-43317 · Other software · Coign · reported by MITREHigh 8.8
An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component.
- Product
- Coign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024 There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escaCVE-2023-6926 · Other software · Crestron · reported by ics-cert@hq.dhs.govHigh 8.4
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.
- Product
- AM-300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session.CVE-2024-23688 · Other software · Consensys · reported by VulnCheckMedium 5.3
Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.
- Product
- Discovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue.CVE-2024-23679 · Other software · Enonic · reported by VulnCheckCritical 9.8
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.
- Product
- XP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site ScriptingCVE-2023-6184 · Other software · Cloud Software Group · reported by secure@citrix.comMedium 5
Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting
- Product
- Citrix Session Recording
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jan 15, 2024An issue in MOKO TECHNOLOGY LTD MOKOSmart MKGW1 BLE Gateway v.1.1.1 and before allows a remote attacker to escalate privileges via the session management componCVE-2023-51059 · Other software · Mokosmart · reported by MITREHigh 8.8
An issue in MOKO TECHNOLOGY LTD MOKOSmart MKGW1 BLE Gateway v.1.1.1 and before allows a remote attacker to escalate privileges via the session management component of the administrative web interface.
- Product
- Mkgw1 Gateway Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commokosmart.com
Jan 12, 2024A session management issue was addressed with improved checks.CVE-2024-0230 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.4
A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic.
- Product
- Magic Keyboard Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 12, 2024The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session.CVE-2023-49262 · Other software · Hongdian · reported by cvd@cert.plCritical 9.8
The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session.
- Product
- H8951-4G-ESP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024 An Improper Handling of Exceptional Conditions vulnerability in BGP session processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticaCVE-2024-21585 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 5.9
An Improper Handling of Exceptional Conditions vulnerability in BGP session processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker, using specific timing outside the attacker's control, to flap BGP sessions and cause the routing protocol daemon (rpd) process to crash and restart, leading to a Denial of Service (DoS) condition. Continued BGP session flapping will create a sustained Denial of Service (DoS) condition. This issue only affects routers configured with non-stop routing (NSR) enabled. Graceful Restart (GR) helper mode, enabled by default, is also required for this issue to be exploitable. Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. When the BGP session flaps on the NSR-enabled router, the device enters GR-helper/LLGR-helper mode due to the peer having negotiated GR/LLGR-restarter capability and the backup BGP requests for replication of the GR/LLGR-helper session, master BGP schedules, and initiates replication of GR/LLGR stale routes to the backup BGP. In this state, if the BGP session with the BGP peer comes up again, unsolicited replication is initiated for t
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.netsupportportal.juniper.net
Jan 10, 2024A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA.CVE-2023-5455 · Other software · Red Hat · reported by Red HatMedium 6.5
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
- Product
- Red Hat Enterprise Linux 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 10, 2024The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session.CVE-2023-48258 · Other software · Rexroth · reported by psirt@bosch.comMedium 5.5
The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted CVE-2023-48256 · Other software · Rexroth · reported by psirt@bosch.comMedium 5.3
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.CVE-2023-48254 · Other software · Rexroth · reported by psirt@bosch.comMedium 5.3
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.CVE-2023-48244 · Other software · Rexroth · reported by psirt@bosch.comMedium 5.3
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 4, 2024Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a uCVE-2023-50082 · Other software · Pbootcms · reported by MITREHigh 7.5
Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform.
- Product
- Pbootcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group nameCVE-2023-50333 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jan 2, 2024Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.CVE-2023-33118 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 2, 2024The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lCVE-2023-33110 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 1, 2024reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.CVE-2023-50094 · Other software · Yogeshojha · reported by MITREHigh 8.8
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
- Product
- Rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023WP Sessions Time Monitoring Full Automatic: Does not sanitize the request URL or query parameters before using them in an SQL queryCVE-2023-5203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
- Product
- WP Sessions Time Monitoring Full Automatic
- Fixed in
- 1.0.9
- What to do
- Update WP Sessions Time Monitoring Full Automatic to 1.0.9 or newer.
Dec 21, 2023Cross-Site Scripting (XSS) vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session idenCVE-2023-50473 · Other software · Billahmed · reported by MITREMedium 5.4
Cross-Site Scripting (XSS) vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers (SID) in index.js file.
- Product
- Qbit Matui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023Windows Local Session Manager (LSM) Denial of Service VulnerabilityCVE-2022-44684 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Local Session Manager (LSM) Denial of Service Vulnerability
- Product
- Windows 10 Version 21H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 19, 2023 Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device.CVE-2023-50707 · Other software · EFACEC · reported by ics-cert@hq.dhs.govCritical 9.6
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device.
- Product
- BCU 500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023A session rendering issue was addressed with improved session tracking.CVE-2023-42940 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.7
A session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their screen may unintentionally share the incorrect content.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Dec 19, 2023A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0.CVE-2023-6913 · Other software · Imou · reported by cve-coordination@incibe.esHigh 8.1
A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.
- Product
- Imou Life app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports.CVE-2023-32725 · Other software · Zabbix · reported by security@zabbix.comCritical 9.6
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comsupport.zabbix.com
Dec 13, 2023Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.CVE-2023-45725 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.7
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: * list * show * rewrite * update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers
- Product
- Apache CouchDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.couchdb.orglists.apache.org
Dec 12, 2023The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application accCVE-2015-8314 · Other software · Heartcombo · reported by MITREHigh 7.5
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Product
- Devise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation.CVE-2023-48929 · Other software · Franklin-electric · reported by MITRECritical 9.8
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resource allows an attacker to escalate privileges and obtain sensitive information.
- Product
- System Sentinel Anyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2023An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SCVE-2023-6269 · Other software · Atos Unify · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 10
An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SBC) and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user.
- Product
- OpenScape Session Border Controller (SBC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 4, 2023Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to snCVE-2022-46480 · Other software · U-tec · reported by MITREHigh 8.1
Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range.
- Product
- Ultraloq Ul3 BT Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarxiv.orgresearchgate.net
Dec 1, 2023PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host.CVE-2023-46746 · Other software · PostHog · reported by GitHubMedium 4.8
PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery (SSRF), which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request. This vulnerability has been addressed in `22bd5942` and will be included in subsequent releases. There are no known workarounds for this vulnerability.
- Product
- posthog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these.CVE-2023-46326 · Other software · Zstack · reported by MITREHigh 8.8
ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.
- Product
- Zstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definitionCVE-2023-49735 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Tiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Nov 30, 2023An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tCVE-2023-31176 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 7.5
An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details.
- Product
- SEL-451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordselinc.comnozominetworks.com
Nov 23, 2023Cron log backup files contain administrator session IDs.CVE-2023-4677 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This issue affects Pandora FMS <= 772.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 21, 2023OpenReplay is a self-hosted session replay suite.CVE-2023-48226 · Other software · openreplay · reported by GitHubMedium 6.5
OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available.
- Product
- openreplay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugcrowd.comcapec.mitre.org
Nov 16, 2023 Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information.CVE-2023-40314 · Other software · The OpenNMS Group · reported by security@opennms.comMedium 5.8
Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Moshe Apelbaum for reporting this issue.
- Product
- Horizon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "CVE-2023-46446 · Other software · Asyncssh Project · reported by MITREMedium 6.8
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."
- Product
- Asyncssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.