CVE-2022-24444

Silverstripe silverstripe/framework through 4.10 allows Session Fixation...

Session fixation

Silverstripe silverstripe/framework through 4.10 allows Session Fixation...

CVE-2022-24444

Silverstripe silverstripe/framework through 4.10 allows Session Fixation...

CVE-2022-24444

CVE-2022-24444 affects Silverstripe framework versions 4.10 and earlier. The issue is a session-fixation vulnerability involving the hybridsessions module when the session-manager module is not installed and session IDs are saved to disk; unexpired SessionIDs of logged-out users can still be used...

CVE-2022-24444

Silverstripe silverstripe/framework through 4.10 allows Session Fixation...

PT-2022-16701 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.10 and earlier Description: The issue allows session fixation, where unexpired SessionIDs of logged out users can still be used to make authenticated requests when the hybridsessions module is us...

Session Fixation

typo3/cms is vulnerable to session fixation. The vulnerability exists because the setAuthorizedAndRedirect function of BackendModuleController.php does not properly revoke tokens after the user account was degraded to lower permissions or disabled completely...

Session fixation

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+...

CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation...

CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation...

Session fixation

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation...

CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation...

CVE-2022-27305

CVE-2022-27305 affects Gibbon v23. After authentication, the application does not generate a new session ID cookie, enabling session fixation risks. This detail is consistently reported across multiple sources (NVD entry for CVE-2022-27305; Red Hat/CVE pages; OSV/PRION/CVE records; CNNVD entry). ...

CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation...

Session Fixation

filegator/filegator is vulnerable to session fixation. The vulnerability exists in the authenticate function in JsonFile.php due to invalid session generation on user update which allows a malicious user to hijack the session...

GHSA-47VG-483W-HP3M Improper user session handling in filegator

FileGator prior to version 7.8.0 is vulnerable to session fixation...

Gibbon 授权问题漏洞

Gibbon is a school platform that solves real-world problems that educators encounter every day. A security vulnerability exists in Gibbon version v23 that stems from the application not generating a new session ID cookie after a user is authenticated.The application is vulnerable to session...

Session fixation vulnerability in Jenkins

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. This vulnerability was introduced in Jenkins 2.266 and LTS 2.277.1. Jenkins 2.300, LTS 2.289.2...

GHSA-4WR9-2XC6-JMG5 Session fixation vulnerability in Jenkins

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. This vulnerability was introduced in Jenkins 2.266 and LTS 2.277.1. Jenkins 2.300, LTS 2.289.2...

GHSA-682G-C99V-9R2G Jenkins Gitlab Authentication Plugin vulnerable to Session Fixation

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...