infinispan: Session fixation protection broken for Spring Session integration

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling...

Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.2 security update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Session fixation

A password generation weakness exists in xquest through 2016-06-13...

Multiple Dell Products DSA-2019-164 Multiple Security Vulnerabilities

Description Multiple Dell products are prone to the following vulnerabilities: 1. A cross-site scripting vulnerability 2. An authentication-bypass vulnerability 3. A session fixation vulnerability An attacker may leverage these issues to execute arbitrary script code in the browser of the victim...

Session Fixation

silverstripe/framework is vulnerable to session fixation. The application does not regenerate the session ID in the Change Password function, allowing a remote attacker with physical access to a victim's node to perform session fixation in the Change Password form...

Session fixation

In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session...

Clario: Affiliates - Session Fixation

SEVERITY: Medium LOCATION: ● https://affiliates.kromtech.com ISSUE DESCRIPTION: User can use the same session token after logout. Attacker can repeat request with token that should be marked as invalidated. PROOF OF VULNERABILITY: Request made after Logout with the same cookie value. curl -i -s -...

GHSA-W7R7-R8R9-VRG2 Session fixation in change password form

SilverStripe through 4.3.3 allows session fixation in the "change password" form...

Session fixation in change password form

SilverStripe through 4.3.3 allows session fixation in the "change password" form...

Session fixation

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal...

Windriver Vxworks Session Fixation

Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options. File data ot500067.nasl...

Session fixation

xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. This allows unauthorized users access to the X session...

Drupal Open Social SA-CONTRIB-2019-075 Session Fixation Vulnerability

Description Drupal Open Social is prone to a session-fixation vulnerability. An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application. Drupal Open Social 8.x-7.0, and 8.x-6.0 through 8.x-6.4 are vulnerable. Technologies Affected...

CVE-2010-3671

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...

Session fixation

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...

CVE-2010-3671

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...

CVE-2010-3671

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...

CVE-2010-3671

TYPO3 prior to 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 are vulnerable to a session fixation flaw (broken authentication/session management) that enables remote attackers to hijack a victim’s session. Impact: session hijacking without user interaction. Vector: networ...

CVE-2019-17062

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...

CVE-2019-17062

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...