475 matches found
CVE-2024-41958-PoC
CVE-2024-41958-PoC This is a small proof of concept for CVE-2024-41958. It is possible to bypass the TFA authentication on the admin panel. Affected versions: 2024-07 Prerequisites needed for the CVE to function: Password and username for an account without TFA. Password and username for an accou...
fortinet-cve-2024-50562
Fortinet SSL-VPN Session Reuse Vulnerability CVE-2024-50562 Professional, permission-only scanner that proves whether a FortiGate invalidates session cookies after logout. A positive finding confirms CVE-2024-50562 — an Insufficient Session Expiration flaw CWE-613 that lets an attacker replay a...
CVE-2025-23419
🔐 TLS Session Reuse Exploit Tester $ BY XIT A Python-based tool to test potential TLS session reuse vulnerabilities that may allow authentication bypass in misconfigured servers. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Do NOT use it on systems...
CVE-2026-86411
A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol FTP transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security TLS, curl fails to perform ...
CVE-2026-41940-Detection
CVE-2026-41940 Detection Detection rules and log schemas for the cPanel/WHM authentication bypass CVE-2026-41940, by Unfold Security. Blog post: cPanel Exploit — CVE-2026-41940 Structure ├── cpanelcve202641940malget.yml SIGMA rule — detects the CRLF injection request ├──...
curl: curl: FTP connection reuse inherits client-certificate
A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol FTP transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security TLS, curl fails to perform ...
CVE-2026-108737 Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...
DEBIAN-CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
UBUNTU-CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
CVE-2026-92414
The Apache Jackrabbit WebDAV server is vulnerable to a Session Fixation and Session Reuse vulnerability. The flaw occurs because the server attaches a cached authenticated session when it detects a match in the Lock-Token , TransactionId , SubscriptionId , or If-header fields without performing a...
CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
EUVD-2026-94406
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...
PT-2026-107579
Name of the Vulnerable Software and Affected Versions Apache Jackrabbit versions 2.23.0 through 2.23.5 Apache Jackrabbit versions 2.22.0 through 2.22.4 Apache Jackrabbit versions 2.20.0 through 2.20.17 Description The WebDAV server allows session fixation and session reuse across users. The syste...
Linux Distros Unpatched Vulnerability : CVE-2026-92414
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any...
CVE-2026-105690
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed the issue where krb5 mounts failed when the client tried to mount shares with incorrect credentials. It turned out that the client was reusing the SMB session from the first mount attempt, even though a differe...