4114 matches found
Cross site request forgery (csrf)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
CVE-2022-24895 Symfony vulnerable to Session Fixation of CSRF tokens
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
CVE-2022-24895
Summary of CVE-2022-24895 : Symfony’s authentication flow regenerates the session ID on login but does not clear CSRF tokens, allowing a potential session-fixation–style attack that could bypass CSRF protection. This is described as a vulnerability in Symfony’s session handling and CSRF-token cle...
CVE-2022-24895 Symfony vulnerable to Session Fixation of CSRF tokens
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
Symfony vulnerable to Session Fixation of CSRF tokens
Description ----------- When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performin...
GHSA-3GV2-29QC-V67M Symfony vulnerable to Session Fixation of CSRF tokens
Description ----------- When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performin...
PT-2023-1575 · Symfony +4 · Symfony +4
Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 4.4 Description: The issue is related to incorrect session management in Symfony, a PHP framework for web and console applications. When authenticating users, Symfony by default regenerates the session ID upon login...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
Session fixation
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
CVE-2020-20402 affects Westbrookadmin portfolioCMS v1.05. The vulnerability enables bypassing password validation and unauthorized access to sensitive information via session fixation. Impact is defined as Confidentiality High with no integrity/availability impact reported; CVSS 3.1 base score 7....
portfolioCMS 授权问题漏洞
portfolioCMS is Bootstrap portfolio website with admin panel. A security vulnerability exists in Westbrookadmin portfolioCMS v1.05. An attacker could exploit the vulnerability to bypass password authentication and gain access to sensitive information via session fixation...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
Session Fixation in https://demo.froxlor.org/
Description The session ID not rotating even after relogin POC 1. Change the PHPSESSID=newsessionchanged and then login 2. Use the same session into new browser and as you can see logged into the account 3. you can try logout and login again the PHPSESSID doesn't change. Video POC:...
Session Fixation
github.com/rancher/rancher is vulnerable to Session Fixation. The vulnerability exists because the library does not properly revoke the generated token after modification is made to the authentication provider, allowing an attacker to retain access to Rancher and the kubectl cluster...
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login...
GHSA-VXMH-P52J-H33M Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login...