4063 matches found
Session fixation
In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session...
Clario: Affiliates - Session Fixation
SEVERITY: Medium LOCATION: ● https://affiliates.kromtech.com ISSUE DESCRIPTION: User can use the same session token after logout. Attacker can repeat request with token that should be marked as invalidated. PROOF OF VULNERABILITY: Request made after Logout with the same cookie value. curl -i -s -...
Session fixation in change password form
SilverStripe through 4.3.3 allows session fixation in the "change password" form...
GHSA-W7R7-R8R9-VRG2 Session fixation in change password form
SilverStripe through 4.3.3 allows session fixation in the "change password" form...
Session fixation
A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal...
Windriver Vxworks Session Fixation
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options. File data ot500067.nasl...
Session fixation
xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. This allows unauthorized users access to the X session...
Drupal Open Social SA-CONTRIB-2019-075 Session Fixation Vulnerability
Description Drupal Open Social is prone to a session-fixation vulnerability. An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application. Drupal Open Social 8.x-7.0, and 8.x-6.0 through 8.x-6.4 are vulnerable. Technologies Affected...
CVE-2010-3671
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...
CVE-2010-3671
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...
Session fixation
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...
CVE-2010-3671
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session...
CVE-2010-3671
TYPO3 prior to 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 are vulnerable to a session fixation flaw (broken authentication/session management) that enables remote attackers to hijack a victim’s session. Impact: session hijacking without user interaction. Vector: networ...
CVE-2019-17062
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...
CVE-2019-17062
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...
Session fixation
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...
CVE-2019-17062
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...
CVE-2019-17062
CVE-2019-17062 affects OXID eShop and editions as follows: 6.x before 6.0.6, 6.1.x before 6.1.5, Enterprise 5.2.x–5.3.x, Professional 4.9.x–4.10.x, and Community 4.9.x–4.10.x. By using a specially crafted URL, an admin user could unintentionally grant unauthorized users access to the admin panel ...