4098 matches found
Session Fixation
Apache Tomcat Catalina is vulnerable to session fixation attack. The vulnerability exists because there is a flaw in checking whether an authentication information authType and principal are cached for a session and the validity of a session token in request when cache==false, allowing an attacke...
CVE-2019-18573
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote...
CVE-2019-18573
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote...
Session fixation
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote...
CVE-2019-18573
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote...
CVE-2019-18573
The CVE describes a Session Fixation vulnerability in RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03. The root cause is that the session token is exposed in the URL, enabling an authenticated local user’s session to be hijacked, after which ...
Apache Tomcat CVE-2019-17563 Session Fixation Vulnerability
Description Apache Tomcat is prone to a session-fixation vulnerability. An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application. Apache Tomcat versions 9.0.0.M1 through 9.0.29 are vulnerable. Technologies Affected Apache Tomcat...
Fixed in Apache Tomcat 7.0.99
Low: Session fixation CVE-2019-17563 When using FORM authentication there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a securit...
Fixed in Apache Tomcat 8.5.50
Low: Session fixation CVE-2019-17563 When using FORM authentication there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a securit...
Fixed in Apache Tomcat 9.0.30
Low: Session fixation CVE-2019-17563 When using FORM authentication there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a securit...
Unspecified Vulnerability in Red Hat Infinispan
Red Hat Infinispan is a distributed caching and key-value NoSQL data storage software from Red Hat Red Hat. A security vulnerability exists in Red Hat Infinispan 9.4.14.Final and prior versions, which stems from the program not properly implementing security against session fixation attacks. No...
EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2546)
According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session...
Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.2 security update
An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
infinispan: Session fixation protection broken for Spring Session integration
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling...
Session fixation
A password generation weakness exists in xquest through 2016-06-13...
Multiple Dell Products DSA-2019-164 Multiple Security Vulnerabilities
Description Multiple Dell products are prone to the following vulnerabilities: 1. A cross-site scripting vulnerability 2. An authentication-bypass vulnerability 3. A session fixation vulnerability An attacker may leverage these issues to execute arbitrary script code in the browser of the victim...
Session Fixation
silverstripe/framework is vulnerable to session fixation. The application does not regenerate the session ID in the Change Password function, allowing a remote attacker with physical access to a victim's node to perform session fixation in the Change Password form...
Session fixation
In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session...
Clario: Affiliates - Session Fixation
SEVERITY: Medium LOCATION: ● https://affiliates.kromtech.com ISSUE DESCRIPTION: User can use the same session token after logout. Attacker can repeat request with token that should be marked as invalidated. PROOF OF VULNERABILITY: Request made after Logout with the same cookie value. curl -i -s -...