4078 matches found
SUSE CVE-2020-26975
When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...
SUSE CVE-2022-40958
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and...
Session fixation
SupportAssist for Home PCs versions 3.11.4 and prior contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sensitive information...
CVE-2022-24895
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
DEBIAN-CVE-2022-24895
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
Cross site request forgery (csrf)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
CVE-2022-24895 Symfony vulnerable to Session Fixation of CSRF tokens
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
CVE-2022-24895 Symfony vulnerable to Session Fixation of CSRF tokens
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
CVE-2022-24895
Summary of CVE-2022-24895 : Symfony’s authentication flow regenerates the session ID on login but does not clear CSRF tokens, allowing a potential session-fixation–style attack that could bypass CSRF protection. This is described as a vulnerability in Symfony’s session handling and CSRF-token cle...
GHSA-3GV2-29QC-V67M Symfony vulnerable to Session Fixation of CSRF tokens
Description ----------- When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performin...
Symfony vulnerable to Session Fixation of CSRF tokens
Description ----------- When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performin...
CVE-2022-24895: Possible CSRF token fixation
More info at https://symfony.com/cve-2022-24895...
CVE-2022-24895: Possible CSRF token fixation
More info at https://symfony.com/cve-2022-24895...
PT-2023-1575 · Symfony +4 · Symfony +4
Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 4.4 Description: The issue is related to incorrect session management in Symfony, a PHP framework for web and console applications. When authenticating users, Symfony by default regenerates the session ID upon login...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
Session fixation
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
portfolioCMS 授权问题漏洞
portfolioCMS is Bootstrap portfolio website with admin panel. A security vulnerability exists in Westbrookadmin portfolioCMS v1.05. An attacker could exploit the vulnerability to bypass password authentication and gain access to sensitive information via session fixation...
CVE-2020-20402
CVE-2020-20402 affects Westbrookadmin portfolioCMS v1.05. The vulnerability enables bypassing password validation and unauthorized access to sensitive information via session fixation. Impact is defined as Confidentiality High with no integrity/availability impact reported; CVSS 3.1 base score 7....