Session fixation

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

CVE-2018-0229

CVE-2018-0229 affects Cisco AnyConnect Secure Mobility Client, ASA, and FTD software configured for SAML 2.0-based SSO. Root cause: ASA/FTD fail to detect if an authentication request originates from the AnyConnect client, enabling a session-fixation path where a user’s IdP authentication token c...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

Session Fixation

ec-cube/ec-cube is vulnerable to session fixation attacks. The vulnerability exists due to the lack of renewal of session cookies, allowing attackers to impersonate an authenticated user...

PT-2018-1772 · Cisco · Cisco Ftd +2

Name of the Vulnerable Software and Affected Versions: Cisco AnyConnect Secure Mobility Client, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the implementation of Security Assertion...

EC-CUBE vulnerable to session fixation

Overview EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability CWE-384. LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD...

JVN#52695336: EC-CUBE vulnerable to session fixation

EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability CWE-384. Impact A remote attacker impersonating a logged in user may perform an unintended operation with the user's privilege. Solution Update the Softwa...

LOCKON EC-CUBE Session Fixing Vulnerability

LOCKON EC-CUBE is an open source e-commerce website building platform developed by LOCKON Japan. The platform supports product login, user evaluation, aesthetic layout and so on. A session fixation vulnerability exists in LOCKON EC-CUBE. A remote attacker can exploit this vulnerability to perform...

SAP Business Objects Session Fixation Vulnerability

SAP Business Objects is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The program provides reporting, performance management and data base and other functions. A session fixation vulnerability exists in SAP Business Objects that stems from the...

SAP Cloud Platform Session Fixation Vulnerability

SAP Cloud Platform is an open Platform-as-a-Service PaaS cloud platform from SAP. The platform is used to build and extend personalized, collaborative and mobile-enabled cloud applications. A session fixation vulnerability exists in SAP Cloud Platform version 2.0, which stems from the program...

Navarino Infinity Session Fixation Vulnerability

Navarino Infinity is a maritime bandwidth management and optimization solution from Navarino Greece. The solution can be used to equip many types of vessels. A session fixation vulnerability exists in Navarino Infinity version 2.1.7. A remote attacker can exploit this vulnerability to hijack...

Session fixation

Escalation of privilege in all versions of the Intel Remote Keyboard allows a local attacker to inject keystrokes into another remote keyboard session...

Mail.ru: [dl.beepcar.ru] CRLF Injection

CRLF Injection via Get request PoC: https://dl.beepcar.ru/qwerty%0ASet-Cookie:%20test=qwerty;domain=.beepcar.ru HTTP Response: HTTP/1.1 302 Moved Temporarily Server: nginx/1.12.2 Date: Tue, 03 Apr 2018 19:20:31 GMT Content-Type: text/html Content-Length: 161 Connection: close Location:...

Navarino Infinity web interface is affected by multiple vulnerabilities.

Overview Navarino Infinity web interface up to version 2.2 is affected by multiple vulnerabilities. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' - CVE-2018-5384| Navarino Infinity exposes an unauthenticated script that is prone to blind sq...

Session fixation

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service denial for the victim's browsing session...

The console login did not rotate the session id during login - CVE-2017-18105

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation...

The console login did not rotate the session id during login - CVE-2017-18105

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation...

Session fixation

A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fixation vulnerability in the web interface has been identified, which may allow an attacker to hijack web sessions...