Overview
nopCommerce, an ecommerce platform, fails to invalidate session cookies upon user logout or session termination, enabling attackers to use the captured cookie to gain access to the application. This vulnerability is extremely similar to CVE-2019-7215. The session cookie can be obtained through XSS, network interception, or a local compromise, and can then be re-used even after the user has logged out. Session hijack attacks have been widely observed for many years, and have been used in ransomware and cryptocurrency theft attacks. Malicious attackers are also known to sell this type of session data online after device compromise.
Description
nopCommerce is an open-source ecommerce platform. The platform is based on ASP.NET core and uses MS SQL 2012 as the backend. The platform is used by a variety of companies, including Microsoft, Volvo, and BMW. nopCommerce is intended for usage within various website stores, and works across shipping APIs, Content Delivery Networks (CDNs) and also offers a login feature for users to save their cart.
A vulnerability has been discovered within the login feature, as it does not invalidate session cookies following user logout or session termination. This vulnerability is tracked as CVE-2025-11699. The vulnerability description is as follows:

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

Attackers have been known to exploit these types of vulnerabilities for numerous reasons. Session cookies and session ID information has been sold on underground forums post device compromise for other attackers to leverage in attacks, and have also been used in ransomware and cryptocurrency theft attacks.
Impact
The theft and re-use of a session cookie by an attacker could result in financial or ransomware attacks by an attacker.
Solution
Version 4.70 and after, with the exception of 4.80.3, fixes the vulnerability put forth by CVE-2025-11699. Users on version 4.80.3, or any version of nopCommerce prior to version 4.70, should update to the latest version, 4.90.3, as soon as possible.
Acknowledgements
Thanks to the reporter, Beatriz Fresno Naumova (beafn28).This document was written by Christopher Cullen.

Overview
The Forge JavaScript library provides TLS-related cryptographic utilities. A vulnerability that allows signature verification to be bypassed through crafted manipulation of ASN.1 structures, particularly in fields such as Message Authentication Code (MAC) data, was identified. Users of the node-forge package, and downstream consumers, are advised to update to the patched version in a timely manner.
Description
Forge (also available as the node-forge npm package) offers a range of cryptographic capabilities, including certificate generation, message signing and verification, and encryption and decryption. These functions depend on the ASN.1 parsing and validation routines of the library.
A flaw in the asn1.validate function was discovered that allows tampered ASN.1 data to pass validation even when cryptographically incorrect. By embedding custom options into certain ASN.1 fields that require recursive verification, an attacker can craft data that appears valid to the Forge verification routines. A proof-of-concept using manipulated PKCS#12 MAC data demonstrated how a forged payload could bypass signature verification.
The researcher who reported this issue has described the potential implications of the flaw as follows:

As a result, applications that rely on node-forge to enforce the structure and integrity of ASN.1-derived cryptographic protocols, including X.509 certificates, PKCS#7 messages, and PKCS#12 archives may be tricked into successfully validating malformed data.

While different environments will experience different levels of practical exposure, the underlying verification bypass is technically significant. The package is widely used, and a fix has been published. A patched release, version 1.3.2, is now available and includes updated test cases in tests/security/cve-2025-12816.js that illustrate the corrected behavior.
Impact
An attacker who can supply crafted ASN.1 data may cause applications relying on Forge for verification to accept forged or modified data as legitimate. This can enable authentication bypass, tampering with signed data, or misuse of certificate-related functions (e.g., cryptographically-signed software). In environments where cryptographic verification plays a central role in trust decisions, the potential impact can be significant.
Solution
Update to Forge version 1.3.2 or later. The fix is available in Pull Request #1124. Developers should integrate the updated version into their projects and distribute updates through their normal release channels.
Acknowledgements
Thanks to Hunter Wodzenski of Palo Alto Networks for responsibly reporting this issue. This document was written by Vijay Sarvepalli.

Overview
Fluent Bit is a logging and metrics processor and forwarder that is used in a variety of cloud and container networking environments. Several vulnerabilities in Fluent Bit have been discovered that could allow for authentication bypass, remote code execution (RCE) and denial of service (DoS) largely enabled by various Fluent Bit plugins and by how Fluent Bit processes tags. Many of these vulnerabilities require an attacker to have network access to a Fluent Bit instance. Fluent Bit has released version 4.0.12, 4.1.1 and 4.2.0 to remediate the vulnerabilities.
Description
Fluent Bit is a logging and metrics processor and forwarder, intended for usage in various cloud and container environments. It is commonly used to forward traffic to a Security Information and Event Management (SIEM) service, such as Splunk, for further analysis. Fluent Bit uses a tagging system to process and manage traffic that it moves. Multiple vulnerabilities have been discovered within Fluent Bit, largely facilitated by various plugins that manipulate or support tags.
Each individual vulnerability is listed below:
CVE-2025-12972
The Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.
CVE-2025-12970
The extract_name() function in the Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer, leading to process crash or arbitrary code execution.
CVE-2025-12969
The Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs.
CVE-2025-12977
The Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, thus impacting data integrity and log routing.
CVE-2025-12978
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.
Impact
The vulnerabilities could be used for authentication bypass, RCE, DoS, and tag manipulation leading to improper function of Fluent Bit.
Solution
The vulnerabilities are all fixed in Fluent Bit version 4.0.12, 4.1.1 and 4.2.0. Users should download and install the latest version of Fluent Bit as soon as possible. The latest version of Fluent Bit is available at https://fluentbit.io/announcements/
Acknowledgements
Thanks to the reporter, Uri Katz of Oligo Security. This document was written by Christopher Cullen.