4113 matches found
Session fixation
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9...
Session Fixation
sylius/sylius is vulnerable to session fixation. The vulnerability exists because the reset password token does not reset to null after the password has been changed, allowing an attacker to change the password without permission and use the same token many times...
Session fixation
An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management EAM versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of...
Session Fixation
shopware/platform is vulnerable to session fixation. Remote unauthenticated attackers are able to gain access to guest sessions because the sessions are shared between customers when HTTP cache is enabled, resulting in inconsistent experiences for guest users...
Security Bulletin: Multiple IBM MQ vulnerabilities affect IBM Sterling Global Mailbox
Summary IBM MQ is shipped with IBM Sterling Global Mailbox. Multiple vulnerabilities impacts IBM MQ. Remediation is available for the issues. Vulnerability Details CVEID: CVE-2019-4227 DESCRIPTION: IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners...
Acronis: Session Fixation on Acronis
Hi there, The application does not set a new Session ID in the cookie after what appears to be an authentication attempt by the user. If this was a successful login and the Session IDs are stored in cookies then this application is affected by Session Fixation vulnerability. Steps To Reproduce...
Session fixation
There is an Assertion in 'contextp-nextscannerinfop-type == SCANNERTYPEFUNCTION' failed at parserparsefunctionarguments in /js/js-parser.c of JerryScript commit a6ab5e9...
Session Fixation in WildFly Elytron
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...
GHSA-7FHR-2694-RG79 Session Fixation in WildFly Elytron
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...
Session Fixation
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...
Insecure Session
IBM MQ is vulnerable to insecure session. The vulnerability exists due to an error where users are not disconnected when they logout allowing an attacker to conduct a session fixation attack...
Session Fixation
github.com/go-gitea/gitea is vulnerable to session fixation. The library does not properly reset the user session after logging out, allowing an attacker to gain privileges via the client-side cookie...
Mitsubishi Electric MELSEC iQ-R Session Fixation (CVE-2020-5654)
Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96...
Mitsubishi IU1 Session Fixation (CVE-2020-5543)
TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allows remote attackers to stop the network functions or execute malware via a specially crafted packet. This plugin only works wit...
Siemens Improper Neutralization of Argument Delimiters in a Command in Wind River VxWorks (CVE-2019-12258)
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. C Tenable,...
Session fixation
IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040...
Security Bulletin: Cross-site scripting and session fixation vulnerability in IBM Financial Transaction Manager for SWIFT Services
Summary Cross-site scripting and session fixation vulnerability in IBM Financial Transaction Manager for SWIFT Services Vulnerability Details CVEID: CVE-2021-39044 DESCRIPTION: IBM Financial Transaction Manager is vulnerable to cross-site request forgery which could allow an attacker to execute...
Session fixation
A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password. Affected Products: EVlink City EVC1S22P4...
Mageia: Security Advisory (MGASA-2015-0227)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mageia: Security Advisory (MGASA-2020-0054)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...