Session Fixation

snipe/snipe-it is vulnerable to session fixation. The vulnerability exists in passwordsave function in ProfileController.php due to not logging the user out of other devices when changing the password which allows the attacker to submit an old password session link to access the system...

X2Engine < 4.0 ProfileController.php Unrestricted File Upload Vulnerability

According to its version number, the X2Engine application installed on the remote web server is prior to version 4.0. It is, therefore, potentially affected by a file upload vulnerability in the '/protected/controllers/ProfileController.php' script. An attacker can exploit this issue to upload...