Session fixation and authentication bypass (authcrypt module)

More info at https://simplesamlphp.org/security/201705-01...

EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2016-1049)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Expression Language EL implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly conside...

pcs daemon session fixation vulnerability

PCS is a set of tools for configuring and managing Pacemaker and Corosync clustering software using the command line and web UI. A session fixation vulnerability exists in the pcs daemon. An attacker can exploit the vulnerability to hijack arbitrary sessions and gain unauthorized access to affect...

Session fixation

The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

DEBIAN-CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

Session fixation

Session fixation vulnerability in pcsd in pcs before 0.9.157...

UBUNTU-CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0721

CVE-2016-0721 describes a session fixation vulnerability in pcsd (part of the PCS/Corosync-Pacemaker tooling) affecting pcs before 0.9.157. The issue arises from how sessions are managed, potentially allowing an attacker to hijack an authenticated session. Affected product: pcs/pcsd components pr...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

Session fixation

MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights...

Session fixation

The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via unspecified vectors...

Session fixation

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL...

Sophos Web Appliance Session Fixation Vulnerability

Sophos Web Appliance SWA is a suite of Web security gateway products from Sophos UK. The product supports real-time web threat protection, customized web filtering and dynamic control of applications. A session fixation vulnerability exists in SWA versions prior to 4.3.1.2. An attacker can exploi...

Session Fixation Attacks

CloudFoundry User Account and Authentication UAA is vulnerable to session fixation attacks. These attacks are possible when UAA is configured to authenticate against OpenID Connect or external SAML based identity providers...

Revive Adserver Session Fixation Vulnerability

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A security vulnerability exists in Revive Adserver versions prior to 3.2.3. An attacker can exploit the...

Session Fixation

HTTP by itself is a stateless protocol; therefore, the server is unable to determine which requests are performed by which client and which clients are authenticated or unauthenticated. The use of HTTP cookies within the headers allows a web server to identify each individual client and can thus...