Session fixation

Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options...

CVE-2019-12258

CVE-2019-12258 affects Wind River VxWorks 6.6–vx7 via the IPNet TCP stack, causing a session-fixation vulnerability that can lead to a TCP DoS from malformed TCP options. Public sources describe this as part of the URGENT/11 set and note the related IPNet flaws across IPv4/TCP handling. Mitigatio...

CVE-2019-12258

Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options...

Session fixation

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media versions: prior to 3.5.0.1...

Session fixation

A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor versions: prior to 5.0.5.1...

CVE-2019-10371

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

Session fixation

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

CVE-2019-10371

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

CVE-2019-10371

CVE-2019-10371 describes a session fixation vulnerability in Jenkins Gitlab Authentication Plugin versions 1.4 and earlier, arising from GitLabSecurityRealm.java that allows an attacker who can control the pre-authentication session to impersonate another user. Affected software: Jenkins Gitlab A...

PT-2019-11767 · Jenkins · Jenkins Gitlab Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gitlab Authentication Plugin version 1.4 and earlier Description: A session fixation issue allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. This is due to a vulnerability in...

Session fixation

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass...

Session fixation

The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not...

Session Fixation

Apache Zeppelin is vulnerable to session fixation attacks. A remote attacker could exploit a flaw in the logout function to hijack a valid user session...

Security Bulletin: IBM Tivoli Netcool Impact Session Management - Session Fixation

Summary IBM Tivoli Netcool Impact did not implement proper Session Management. The attacker can fix the users session and lure the victim to login with the Arbitrary session he created, further results into Session hijacking. Vulnerability Details CVEID: Not Applicable DESCRIPTION: No CVE...

Session fixation

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure PCS 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices...

Session fixation

IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 158515...

CVE-2019-6584

A vulnerability has been identified in SIEMENS LOGO!8 6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx, SIEMENS LOGO!8 6ED1052-xyy08-0BA0 FS:01 / Firmware version V1.82.02. The integrated webserver does not invalidate the Session ID upon user logout. An attacker that...

Siemens LOGO!8 Devices

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO!8 devices Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Session Fixation 2. RISK EVALUATION Successful exploitation of these...

CVE-2019-10158

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling...

Session fixation

Protection Mechanism Failure in the Firewall in McAfee Endpoint Security ENS 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection where GTI flagged IP addresses are not blocked by the ENS Firewall via specially crafted malicious sites where the GTI...