The vulnerability of Huawei TC7001-10, WS7200-10, and WS7206-10 Wi-Fi routers lies in the lack of a mechanism to lock sessions. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of Huawei TC7001-10, WS7200-10, and WS7206-10 Wi-Fi routers’ microprogramming software is related to the lack of a session fixation mechanism, due to the absence of reverse address checking and TCP connection tracing. Exploiting this vulnerability can allow an unauthorized actor...

Session Fixation

TYPO3 is vulnerable to Session Fixation. The vulnerability is due to existing sessions for a user account not being revoked when the user changes their password...

CVE-2024-38513

Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own sessionid value, resulting in the creation of a session with that key. If...

CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability

Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own sessionid value, resulting in the creation of a session with that key. If...

CVE-2024-38513

The CVE-2024-38513 issue affects the GoFiber (Fiber) session middleware in GoFiber versions prior to 2.52.5. The vulnerability allows a user to supply their own session_id value, which can cause a session to be created with that key. This can enable unauthorized access or session fixation if an a...

CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability

Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own sessionid value, resulting in the creation of a session with that key. If...

CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability

Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own sessionid value, resulting in the creation of a session with that key. If...

Fiber Security Breach

Fiber is an open source web framework written in the Go language. A security vulnerability exists in Fiber versions prior to 2.52.5 that stems from a problem with the session middleware, which can lead to unauthorized access and session fixation attacks...

Session Fixation

zendframework/zendframework is vulnerable to Session Fixation. The vulnerability is due to session validators not working as expected if set prior to the start of a session...

CVE-2024-24552

A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing...

CVE-2024-24552 Bludit is Vulnerable to Session Fixation

A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing...

CVE-2024-24552

CVE-2024-24552 describes a session fixation vulnerability in Bludit that can allow an attacker to bypass authentication by tricking an administrator or user into using a session ID of the attacker’s choosing. Affected software: Bludit (CMS). Root cause: improper handling of session IDs enabling f...

CVE-2024-24552 Bludit is Vulnerable to Session Fixation

A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing...

CVE-2024-24552 Bludit is Vulnerable to Session Fixation

A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing...

PT-2024-20444

Name of the Vulnerable Software and Affected Versions Bludit affected versions not specified Description A session fixation issue allows an attacker to bypass the server's authentication by tricking an administrator or any user into authorizing a session ID of their choosing. Recommendations At t...

Bludit Authorization Issues Vulnerability

Bludit is an open source, lightweight blog content management system CMS. Bludit suffers from an authorization issue vulnerability that stems from the presence of a session fixation vulnerability, which allows an attacker to trick an administrator or any other user into authorizing a session ID o...

Session Fixation

Evmos is vulnerable to Session Fixation. The vulnerability is due to the improper handling of contract balances during interchain transactions involving a local state change and an ICS20 transfer. An attacker can exploit this flaw to artificially increase the supply of Evmos tokens by manipulatin...

GO-2024-2637 Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

Account Takeover via Session Fixation in Zitadel Bypassing MFA in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

Session Fixation

typo3/cms-core is vulnerable to Session Fixation. The vulnerability is due to the existing sessions not being revoked when a user changes their passwords, which can be exploited by an attacker with a valid backend or frontend user account...

RHEL 8 : tomcat (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - tomcat: Fix for CVE-2023-24998 was incomplete CVE-2023-28709 Note that Nessus has not tested for this issue but has...