GHSA-43G4-487M-5Q6M Open WebUI Vulnerable to a Session Fixation Attack

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

CVE-2024-7053

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-7053

...

CVE-2024-7053

...

CVE-2024-7053 Session Fixation in open-webui/open-webui

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

CVE-2024-7053

Open WebUI (open-webui/open-webui) version 0.3.8 is affected by a session-fixation vulnerability. A user-level attacker can induce the administrator’s cookie to be sent over HTTP to a cross-origin domain due to SameSite=Lax and missing Secure flag, enabling cookie leakage via a malicious markdown...

PT-2025-12183

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A vulnerability allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secu...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. A security vulnerability exists in Open WebUI version 0.3.8, which stems from a session fixation attack that could lead to an administrator account takeover...

CVE-2025-27661

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004...

CVE-2025-27661

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004...

CVE-2025-27661

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004...

CVE-2025-27661

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004...

Vasion Print 授权问题漏洞

Vasion Print is a SaaS-based, cloud-hosted application from Vasion for managing and deploying printers. A security vulnerability exists in Vasion Print versions prior to 22.0.843 and Application 20.0.1923 that stems from the presence of a session fixation issue...

CVE-2025-27661

CVE-2025-27661 affects Vasion Print (formerly PrinterLogic) prior to Virtual Appliance Host 22.0.843 / Application 20.0.1923. The issue is a session fixation vulnerability (OVE-20230524-0004). Affected component: the web/app layer serving printer management; root cause details are not further ela...

CVE-2025-27661

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004...

Linux Distros Unpatched Vulnerability : CVE-2022-24895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the...

Linux Distros Unpatched Vulnerability : CVE-2016-0721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Session fixation vulnerability in pcsd in pcs before 0.9.157. CVE-2016-0721 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2019-17563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could...

Session Fixation

github.com/mattermost/mattermost-server is vulnerable to Session Fixation. The vulnerability is due to improper session invalidation when converting a user to a bot, allows the user to retain their previous session and potentially escalate privileges based on the bot’s assigned permissions...

Linux Distros Unpatched Vulnerability : CVE-2011-4718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID...