CVE-2020-35591

Pi-hole 5.0, 5.1, and 5.1.1 are affected by a session fixation vulnerability. The issue arises because the application does not generate a new session cookie after login, allowing a malicious user to forge a new session cookie value and gain access to a victim’s account after they log in. Connect...

Pi-hole 授权问题漏洞

Pi-hole is a multi-platform, network-wide ad-blocking tool. A session fixation vulnerability exists in Pi-hole 5.0, 5.1, 5.1.1. The vulnerability stems from the application failing to generate a new session cookie after a user logs in.An attacker can exploit this vulnerability to gain access to...

Pi-hole Web Interface < 5.4 Multiple Vulnerabilities

The Pi-hole Web Interface previously AdminLTE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Session fixation

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in GTA GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prior to 9.3...

IBM Security Verify Information Queue 安全漏洞

IBM Security Verify Information Queue is a cross-product integrator that leverages Kafka technology and a publish/subscribe model to integrate data between IBM security products. A session fixation vulnerability exists in IBM Security Verify Information Queue. The vulnerability stems from incorre...

Session fixation

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Session fixation

SKYWORTH GN542VF Boa version 0.94.13 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-15220 Session fixation

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2021-04656)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 84. When a malicious application installed on a user's device broadcasts intent to Firefox for Android, it can specify arbitrary...

IBM Spectrum Protect Plus Session Fixation Vulnerability

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A session fixation vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. The vulnerability stems fr...

Session fixation

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657...

IBM Spectrum Protect Plus 授权问题漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A session fixation vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. The vulnerability stems fr...

Session Fixation

firefox is vulnerable to session fixation. Firefox for Android allows a malicious application to broadcast a user's Intent with arbitrary headers, allowing attacks such as session fixation...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

Session fixation

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

IBM Cloud Pak System Session Fixation Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A session fixation vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit this vulnerability to emulate another user on the system...

IBM Cloud Pak System 安全漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A session fixation vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit this vulnerability to emulate another user on the system...

CVE-2020-25198

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies...

CVE-2020-25198

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies...