4175 matches found
PT-2022-24176 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.2.4 through 2.3.3 Description: The issue concerns the database webserver session backend, which was susceptible to session fixation. This means an attacker could potentially fixate a session ID on a user's browser,...
Apache Airflow Licensing Issue Vulnerability (CNVD-2022-76236)
Apache Airflow is the Apache Foundation's open source platform for creating, managing, and monitoring workflows. A security vulnerability exists in Apache Airflow versions 2.2.4 to 2.3.3, which stems from the vulnerability of the "database" web server session backend to session fixation. No detai...
Session fixation
An issue was discovered in wolfSSL before 5.5.0 when --enable-session-ticket is used; however, only version 5.3.0 is exploitable. Man-in-the-middle attackers or a malicious server can crash TLS 1.2 clients during a handshake. If an attacker injects a large ticket more than 256 bytes into a...
Session Fixation
github.com/vmware-tanzu/pinniped is vulnerable to session fixation. The vulnerability exists due to an insufficient session expiration used in the validateAccessToken function of tokenexchange.go, allowing an attacker to use the access token to continue the session without refreshing the token wh...
Session fixation
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor before v0.19.0. A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow...
Session fixation
Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session...
Session fixation
The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's...
Session Fixation
snipe/snipe-it is vulnerable to session fixation. The vulnerability exists in passwordsave function in ProfileController.php due to not logging the user out of other devices when changing the password which allows the attacker to submit an old password session link to access the system...
Insufficient Session Expiration in snipe/snipe-it
Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change...
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
Session fixation
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p is affected by CVE-2022-31798: an XSS vulnerability combined with local session fixation via the PHPSESSID when devices are chained, enabling account takeover of admin or lower-privileged users. The issue arises at the /card_scan.php?CardFormatNo= endpoint....
CVE-2022-31798
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
Session fixation
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997
CVE-2022-2997 affects the Snipe-IT project (snipe/snipe-it) prior to 6.0.10. Root cause: a session-fixation issue where the session is not invalidated after a password change. Impact: could enable unauthorized access to user accounts if exploited. Remediation: upgrade to version 6.0.10 or later; ...