4072 matches found
Session fixation
An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...
opencart 3.0.3.8 - Sessjion Injection Vulnerability
Exploit Title: opencart 3.0.3.8 - Sessjion Injection Exploit Author: Hubert Wojciechowski Contact Author: email protected Company: https://redteam.pl Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/ Version: 3.0.3.8 Testeted on: Windows 10 using XAMPP,...
Opencart 3.0.3.8 Session Injection
Exploit Title: opencart 3.0.3.8 - Sessjion Injection Date: 28/11/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Company: https://redteam.pl Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/ Version: 3.0.3.8 Testeted on: Windows 10...
Session fixation
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call...
Session fixation
Protection mechanism failure in the firmware for the IntelR Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user to enable a denial of service via local access...
Mozilla Firefox Security Advisory (MFSA2015-04) - Linux
This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
Session fixation
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...
Session fixation
An issue was discovered in FusionPBX before 4.5.30. The faxextension may have risky characters it is not constrained to be numeric...
Session Fixation
jupyterhub is vulnerable to session fixation. The vulnerability exists due to the incomplete logout in the single-user server. An attacker is able to reinstate another user's session if another active session is open...
Apache HTTP Server Session Fixation Vulnerability (Jul 2013) - Linux
Apache HTTP Server is prone to a session fixation vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
Apache Tomcat 6.0.x < 6.0.37 Multiple Vulnerabilities - Linux
Apache Tomcat is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2021-20324
A flaw was found in WildFly Elytron. A variation to the use of a session fixation exploit when using Undertow was found despite Undertow switching the session ID after authentication. The highest threat from this vulnerability is to data confidentiality and integrity. Mitigation This attack is...
NewStart CGSL CORE 5.05 / MAIN 5.05 : tomcat Multiple Vulnerabilities (NS-SA-2021-0144)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has tomcat packages installed that are affected by multiple vulnerabilities: - When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacke...
Session Fixation in kasuganosoras/pigeon
✍️ Description Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application. When authenticating a user, it doesn't assign a new sessio...
Session Fixation
camaleoncms is vulnerable to session fixation. Even after the password is changed, the library does not terminate the user's active session, allowing a malicious user to gain unauthorized access to the application...
jenkins: session fixation vulnerability
Session fixation vulnerability was found in Jenkins. The existing session on login process are not invalidated and this allows an attacker to gain potentially additional access on Jenkins by using social engineering attack techniques on a target user...
Apache Tomcat Session Fixation Vulnerability (Nov 2012) - Linux
Apache Tomcat is prone to a session fixation vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
Session Fixation in admidio/admidio
Description admin create a membermember role user named B then B log in to the Admidio after that user B already logged into the Admidio, Admin decide to delete all Roles of user B but user B can do anything that he/she can do before...