CVE-2021-3740: Session Fixation

A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a...

PT-2024-10979 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.4.0 Description: A Session Fixation issue exists, where the application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This ca...

Chatwoot 授权问题漏洞

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. An authorization issue vulnerability exists in versions prior to Chatwoot 2.4.0 that stems from the presence of a session fixation...

Fortinet FortiOS Access Control Error Vulnerability (CNVD-2024-49648)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An access control error...

GHSA-H23J-73WW-7594 Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenId Connect Authentication Plugin 4.421.v5422614ebe0a invalidates...

Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenId Connect Authentication Plugin 4.421.v5422614ebe0a invalidates...

Session Fixation

Apache Kylin is vulnerable to Session Fixation. The vulnerability is due to improper handling of session identifiers, allowing an attacker to hijack a user's session...

Session fixation vulnerability in oic-auth

oic-auth 4.418.vccc7061f5b6d and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. oic-auth 4.421.v5422614ebe0a invalidates the existing session on login...

CVE-2023-50176

A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link...

CVE-2023-50176

A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link...

CVE-2023-50176

A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link...

CVE-2023-50176

A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link...

CVE-2023-50176

Fortinet FortiOS 7.0.0–7.0.13, 7.2.0–7.2.7, and 7.4.0–7.4.3 are affected by CVE-2023-50176, a session-fixation flaw that enables an attacker to execute unauthorized code or commands via a phishing SAML authentication link. Multiple connected sources (Red Hat, CNVD, CVE/CVEList, NVD, PT Security) ...

Fortinet FortiOS 授权问题漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An access control error...

PT-2024-8775

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.0.0 through 7.0.13 Fortinet FortiOS versions 7.2.0 through 7.2.7 Fortinet FortiOS versions 7.4.0 through 7.4.3 Description: A session fixation issue in Fortinet FortiOS allows an attacker to execute unauthorized co...

CVE-2023-52268: Session Fixation

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

Fortinet Fortigate - SSLVPN session hijacking using SAML authentication (FG-IR-23-475)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-475 advisory. - A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows...

FortiOS - SSLVPN session hijacking using SAML authentication

...

CVE-2023-50176: Session Fixation

A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link...

CVE-2024-10318

A session fixation vulnerability was found in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim,...