4062 matches found
Session Fixation
@fastify/passport is vulnerable to Session Fixation. The vulnerability exists because the user validations do not properly perform in the logIn and logOut functions of SecureSessionManager.ts, which allows an attacker to hijack the victim's session by tossing a valid sessionId cookie in the...
CVE-2023-29019
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using @fastify/passport in affected versions for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation...
Session fixation
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using @fastify/passport in affected versions for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation...
GHSA-4M3M-PPVX-XGW9 Session fixation in fastify-passport
Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. Details fastify applications rely on the @fastify/passport library fo...
Session fixation in fastify-passport
Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. Details fastify applications rely on the @fastify/passport library fo...
CVE-2023-29019
The CVE-2023-29019 issue affects the @fastify/passport package used with @fastify/session. The login flow preserves the sessionId between pre-login and authenticated sessions due to the authenticate function, enabling session fixation by network or same-site attackers who can supply a valid sessi...
CVE-2023-29019 Session fixation in fastify-passport
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using @fastify/passport in affected versions for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation...
CVE-2023-29019 Session fixation in fastify-passport
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using @fastify/passport in affected versions for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation...
CVE-2023-29019 Session fixation in fastify-passport
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using @fastify/passport in affected versions for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation...
PT-2023-22091 · Unknown · @Fastify/Passport +1
Name of the Vulnerable Software and Affected Versions: @fastify/passport versions prior to the version that regenerates sessionId upon login Description: Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management...
Session fixation
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...
Siemens SICAM Q100 Session Fixation (CVE-2022-43398)
A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50. Affected devices do not renew the session cookie after login/logout and also accept us...
Session fixation
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account...
GHSA-4QMM-CV4R-QFR4 alextselegidis/easyappointments Session Fixation vulnerability
alextselegidis/easyappointments is vulnerable to session fixation. The application does not generate a new easession cookie after the user authenticates. A malicious user may create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid,...
alextselegidis/easyappointments Session Fixation vulnerability
alextselegidis/easyappointments is vulnerable to session fixation. The application does not generate a new easession cookie after the user authenticates. A malicious user may create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid,...
CVE-2023-2105
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
Session fixation
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-2105
CVE-2023-2105 concerns the Easy!Appointments project by alextselegidis. The issue is a session fixation vulnerability where the application does not generate a new ea_session cookie after user authentication, allowing a malicious actor to inject a session cookie and gain access after login. The f...