4063 matches found
CVE-2020-12258
rConfig 3.9.4 is affected by multiple CVEs with concrete details in connected docs. Affected product/component: rConfig 3.9.4 (devicemgmnt.php and related input handling). Root cause: inadequate validation of user-controlled input leading to cross-site scripting (CVE-2020-12256, CVE-2020-12259) a...
CVE-2020-12258
rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259...
CVE-2020-1993
The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.1...
CVE-2020-1993
The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.1...
Session fixation
The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.1...
CVE-2020-1993
CVE-2020-1993 affects PAN-OS GlobalProtect Portal. The vulnerability stems from not issuing a new session identifier after a successful login, enabling session fixation if an attacker controls a user’s session ID. Affected versions include PAN-OS 7.1 and 8.0, PAN-OS 8.1 prior to 8.1.14, and PAN-O...
CVE-2020-1993 PAN-OS: GlobalProtect Portal PHP session fixation vulnerability
The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.1...
PAN-OS: GlobalProtect Portal PHP session fixation vulnerability
The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. Work around: There are no known workarounds for this issue...
Session fixation
fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPassword option. This may lead to unintended KWallet storage of a password...
Session fixation
Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak...
The vulnerability of the Apache Tomcat application server’s authentication mechanism lies in the lack of session fixation mechanisms. This allows attackers to gain unauthorized access to confidential data, cause service failures, and compromise data integrity.
The vulnerability of the Apache Tomcat application server’s authentication mechanism is related to the lack of session fixation mechanisms. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data, cause service failures, and compromise data integrity...
Facebook Launches 'Discover,' A Secure Proxy to Browse the Internet for Free
More than six years after Facebook launched its ambitious Free Basics program to bring the Internet to the masses, the social network is back at it again with a new zero-rating initiative called Discover. The service, available as a mobile web and Android app, allows users to browse the Internet...
CVE-2020-12467
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...
CVE-2020-12467
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...
Session fixation
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...
CVE-2020-12467
CVE-2020-12467 affects Subrion CMS 4.2.1. The vulnerability arises from a session fixation flaw where an alphanumeric value in a session cookie can be used to establish a session. Documented impact is limited to session fixation; no broader exploitation details are provided. No official remediati...
CVE-2020-12467
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...
CVE-2020-10714
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...
Library CMS Powerful Book Management System 2.2.0 - Session Fixation
Exploit Title: Library CMS Powerful Book Management System 2.2.0 - Session Fixation Date: 2020-04-22 Exploit Author: Ismail Tasdelen Vendor Homepage: https://kaasoft.pro/ Software : https://codecanyon.net/item/library-cms-powerful-book-management-system/21105281 Product Version: v2.2.0 Product :...