CVE-2025-28242: Session Fixation

Improper session management in the /loginok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack...

CVE-2024-49825

CVE-2024-49825 affects IBM Robotic Process Automation and IBM RPA for Cloud Pak, versions 21.0.0–21.0.7.20 and 23.0.0–23.0.20. Root cause: sessions are not invalidated after logout, enabling an authenticated user to impersonate another user. IBM’s bulletin cites CWE-613 and CVSS v3.1 base score 6...

CVE-2024-49825 IBM Robotic Process Automation session fixation

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2024-49825 IBM Robotic Process Automation session fixation

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2024-49709: Session Fixation

Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser might set such a cookie, wait until the user logs in and then use the same cookie to take over the account. Moreover, the system does not...

CVE-2025-0126

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126 PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126

CVE-2025-0126 affects PAN-OS GlobalProtect SAML login where a session fixation flaw allows an attacker to impersonate a legitimate user after the user clicks a malicious link. The PAN-OS PAN-OS management interface SAML login is not affected; Cloud NGFW and Prisma Access instances are proactively...

CVE-2025-0126 PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

Palo Alto Networks PAN-OS 授权问题漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from session fixation and could allow an attacker to impersonate a legitimate user...

CVE-2025-0126: Session Fixation

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

ABB Cylon Aspect 3.08.02 - PHP Session Fixation

Exploit title: ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability Advisory ID: ZSL-2025-5916 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5916.php CVE ID: CVE-2024-11317 CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-11317 Vendor: ABB Ltd. Product web page:...

PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

PT-2025-16006 · Palo Alto Networks · Globalprotect

Name of the Vulnerable Software and Affected Versions: GlobalProtect versions affected versions not specified Description: A session fixation issue in the GlobalProtect login, when configured using SAML, allows an attacker to impersonate a legitimate authorized user. This requires the legitimate...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h11 / 10.2.x < 10.2.10-h6 / 11.0.x < 11.0.6 / 11.1.x < 11.1.5 / 11.2.x < 11.2.3 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h11 or 10.2.x prior to 10.2.10-h6 or 11.0.x prior to 11.0.6 or 11.1.x prior to 11.1.5 or 11.2.x prior to 11.2.3. It is, therefore, affected by a vulnerability. When configured using SAML, a session...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation when database session storage is enabled - which it is not by default. A user whose session has been deleted via web interface or API can continue to access the session. User sessions that are automatically deleted due ...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation when database session storage is enabled - which it is not by default. A user whose session has been deleted via web interface or API can continue to access the session. User sessions that are automatically deleted due ...

CVE-2025-29928: Session Fixation

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

CVE-2024-7053

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...