7570 matches found
ws-web-aiohttp (>=0.1.0a88, <=0.1.0b19) potentially affected by CVE-2018-1000814 via aiohttp-session (0.8.0)
aiohttp-session PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - ws-web-aiohttp =0.1.0a88, =0.1.0b19 Source cves: CVE-2018-1000814 Source advisory: OSV:PYSEC-2018-35...
reliz (0.1.0.dev0) potentially affected by CVE-2018-1000814 via aiohttp-session (2.1.0)
aiohttp-session PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - reliz 0.1.0.dev0 Source cves: CVE-2018-1000814 Source advisory: OSV:PYSEC-2018-35...
Improper access control
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...
CVE-2018-1000814
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...
CVE-2018-1000814
CVE-2018-1000814 affects aiohttp-session versions 2.6.0 and earlier. The vulnerability lies in EncryptedCookieStorage and NaClCookieStorage, allowing non-expiring (infinite) sessions. Exploitation described as recreation of a cookie post-expiry with the same value; no explicit fixes are provided ...
reliz (0.1.0.dev0), ws-web-aiohttp (>=0.1.0a88, <=0.1.0b19) potentially affected by CVE-2018-1000814 via aiohttp-session (>=0.8.0, <=2.1.0)
aiohttp-session PYPI version =0.8.0, =0.1.0a88, =0.1.0b19 Source cves: CVE-2018-1000814 Source advisory: MEND:CVE-2018-1000814...
CVE-2018-1000814
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...
CVE-2018-1000814: Insufficient Session Expiration
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...
PT-2018-9538
Name of the Vulnerable Software and Affected Versions aio-libs aiohttp-session versions 2.6.0 and earlier Description The issue concerns a problem in EncryptedCookieStorage and NaClCookieStorage, which can lead to non-expiring sessions or infinite lifespan. This can be exploited by recreating a...
reliz (0.1.0.dev0) potentially affected by CVE-2018-1000519 via aiohttp-session (2.1.0)
aiohttp-session PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - reliz 0.1.0.dev0 Source cves: CVE-2018-1000519 Source advisory: OSV:GHSA-FPWP-69XV-C67F...
ws-web-aiohttp (>=0.1.0a88, <=0.1.0b19) potentially affected by CVE-2018-1000519 via aiohttp-session (0.8.0)
aiohttp-session PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - ws-web-aiohttp =0.1.0a88, =0.1.0b19 Source cves: CVE-2018-1000519 Source advisory: OSV:GHSA-FPWP-69XV-C67F...
reliz (0.1.0.dev0) potentially affected by CVE-2018-1000519 via aiohttp-session (2.1.0)
aiohttp-session PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - reliz 0.1.0.dev0 Source cves: CVE-2018-1000519 Source advisory: GHSA-FPWP-69XV-C67F...
aiohttp-session Session Fixation vulnerability
The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in loadsession function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies ?session=, or meta tags or script tags wi...
GHSA-FPWP-69XV-C67F aiohttp-session Session Fixation vulnerability
The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in loadsession function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies ?session=, or meta tags or script tags wi...
aio-libs aiohttp-session session fixation vulnerability
aio-libs aiohttp-session is an application that supports storing user-specific data into session objects. A session fixation vulnerability exists in the 'RedisStorage' function of RedisStorage in aio-libs aiohttp-session. An attacker can exploit this vulnerability to hijack a session with the hel...
CVE-2018-1000519
aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.pyL42 that can result in Session Hijacking. This attack appear to be exploitable via Any method that...
CVE-2018-1000519
aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.pyL42 that can result in Session Hijacking. This attack appear to be exploitable via Any method that...
Session fixation
aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.pyL42 that can result in Session Hijacking. This attack appear to be exploitable via Any method that...
reliz (0.1.0.dev0) potentially affected by CVE-2018-1000519 via aiohttp-session (2.1.0)
aiohttp-session PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - reliz 0.1.0.dev0 Source cves: CVE-2018-1000519 Source advisory: OSV:PYSEC-2018-80...
ws-web-aiohttp (>=0.1.0a88, <=0.1.0b19) potentially affected by CVE-2018-1000519 via aiohttp-session (0.8.0)
aiohttp-session PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp-session and may be impacted: - ws-web-aiohttp =0.1.0a88, =0.1.0b19 Source cves: CVE-2018-1000519 Source advisory: OSV:PYSEC-2018-80...