CVE-2024-45651

IBM Sterling Connect:Direct Web Services versions 6.1.0, 6.2.0, and 6.3.0 expose a session-fixation issue: closing a browser does not invalidate the session, potentially allowing an authenticated user to impersonate another user. Remediation per IBM bulletin is to upgrade to fixed versions: 6.3.0...

CVE-2024-49825 IBM Robotic Process Automation session fixation

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2024-49825

CVE-2024-49825 affects IBM Robotic Process Automation and IBM RPA for Cloud Pak, versions 21.0.0–21.0.7.20 and 23.0.0–23.0.20. Root cause: sessions are not invalidated after logout, enabling an authenticated user to impersonate another user. IBM’s bulletin cites CWE-613 and CVSS v3.1 base score 6...

CVE-2024-49825 IBM Robotic Process Automation session fixation

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2025-0126

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126

CVE-2025-0126 affects PAN-OS GlobalProtect SAML login where a session fixation flaw allows an attacker to impersonate a legitimate user after the user clicks a malicious link. The PAN-OS PAN-OS management interface SAML login is not affected; Cloud NGFW and Prisma Access instances are proactively...

CVE-2025-0126 PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126 PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

Palo Alto Networks PAN-OS 授权问题漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from session fixation and could allow an attacker to impersonate a legitimate user...

ABB Cylon Aspect 3.08.02 - PHP Session Fixation

Exploit title: ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability Advisory ID: ZSL-2025-5916 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5916.php CVE ID: CVE-2024-11317 CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-11317 Vendor: ABB Ltd. Product web page:...

PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h11 / 10.2.x < 10.2.10-h6 / 11.0.x < 11.0.6 / 11.1.x < 11.1.5 / 11.2.x < 11.2.3 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h11 or 10.2.x prior to 10.2.10-h6 or 11.0.x prior to 11.0.6 or 11.1.x prior to 11.1.5 or 11.2.x prior to 11.2.3. It is, therefore, affected by a vulnerability. When configured using SAML, a session...

PT-2025-16006 · Palo Alto Networks · Globalprotect

Name of the Vulnerable Software and Affected Versions: GlobalProtect versions affected versions not specified Description: A session fixation issue in the GlobalProtect login, when configured using SAML, allows an attacker to impersonate a legitimate authorized user. This requires the legitimate...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation when database session storage is enabled - which it is not by default. A user whose session has been deleted via web interface or API can continue to access the session. User sessions that are automatically deleted due ...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation when database session storage is enabled - which it is not by default. A user whose session has been deleted via web interface or API can continue to access the session. User sessions that are automatically deleted due ...

CVE-2024-7053

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

GHSA-43G4-487M-5Q6M Open WebUI Vulnerable to a Session Fixation Attack

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

Open WebUI Vulnerable to a Session Fixation Attack

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

CVE-2024-7053

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...