4073 matches found
MGASA-2022-0344 Updated firefox packages fix security vulnerabilities
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead CVE-2022-40956. By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus...
Session fixation
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6...
Session fixation
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2...
CVE-2022-40958
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that by injecting a cookie with certain special characters, an attacker on a shared subdomain, which is not a secure context, could set and overwrite cookies from a secure context, leading to session fixatio...
Mozilla Firefox 注入漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 105, which stems from the fact that by injecting a cookie with certain special characters, an attacker on a shared subdomain in a...
Mozilla Firefox < 105.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 105.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-40 advisory. - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing...
Mozilla Firefox < 105.0
The version of Firefox installed on the remote Windows host is prior to 105.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-40 advisory. - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team...
Mozilla Firefox ESR < 102.3
The version of Firefox ESR installed on the remote Windows host is prior to 102.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-41 advisory. - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team...
Cookie is persisting in the browser which leads to Session Fixation
Description After logging in and logging out, the application continues to use the preauthentication cookies. The cookies are same after closing the browser and after password change .And also same cookies are reassigning for another user's login which can leads to session fixation. Proof of...
Session fixation
SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...
Session fixation
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2...
GHSA-G6VM-3CH8-C6JQ Apache IoTDB Session Fixation vulnerability
Apache IoTDB version 0.13.0 is vulnerable to session id attack. Users should upgrade to version 0.13.1 which addresses this issue...
Apache IoTDB Session Fixation vulnerability
Apache IoTDB version 0.13.0 is vulnerable to session id attack. Users should upgrade to version 0.13.1 which addresses this issue...
GHSA-5FF8-7639-6V6G Apache Airflow Session Fixation vulnerability
In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...
Apache Airflow Session Fixation vulnerability
In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...
CVE-2022-38054
In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...
CVE-2022-38054
In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...
PYSEC-2022-263
In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...
