442 matches found
jenkins: deleting a user record will does not invalidate existing sessions
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have...
Session fixation
Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2018-13282
CVE-2018-13282 affects Synology Photo Station through the SYNO.PhotoStation.Auth component. Versions prior to 6.8.7-3481 are vulnerable to a session fixation flaw that allows remote attackers to hijack web sessions via the PHPSESSID parameter. The description is corroborated by multiple sources (...
CVE-2018-13282
Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
Hirschmann Automation and Control GmbH Classic Platform Switches
CVSS v3 7.5 ATTENTION: Exploitable remotely/high skill level is needed to exploit. Vendor: Hirschmann Automation and Control GmbH, a division of Belden Inc. Equipment: Classic Platform Switches Vulnerabilities: Session Fixation, Information Exposure Through Query Strings in GET Request, Cleartext...
Open redirect
Open Ticket Request System OTRS 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email...
CVE-2017-17476
Open Ticket Request System OTRS 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email...
CVE-2017-17476
Open Ticket Request System OTRS 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email...
Session fixation vulnerability in Rails
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...
GHSA-JWHV-RGQC-FQJ5 Session fixation vulnerability in Rails
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...
Moderate severity vulnerability that affects rails
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...
Session fixation
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2017-12965
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2017-12965
Apache2Triad v1.5.4 on Windows is affected by CVE-2017-12965, a session-fixation vulnerability that allows remote attackers to hijack web sessions via the PHPSESSID parameter. Descriptions across sources (NVD/CNVD) consistently identify Session Fixation as the issue; exploit details are not provi...
Session fixation
Session fixation vulnerability in Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id...
CVE-2015-1174
Session fixation vulnerability in Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id...
CVE-2015-1174
Session fixation vulnerability in Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id...
CVE-2015-1174
CVE-2015-1174 affects Unit4 Polska TETA Web (formerly TETA Galactica) up to version 22.62.3.4. The vulnerability is a session fixation flaw that allows a remote attacker to hijack a user’s web session by manipulating the session identifier. The CNVD entry corroborates the affected software and vu...