Session Fixation

Description The session is not invalidated after a password change. Proof of Concept Open Snipe-IT in the browser and login. Do the same in a private window such that there are two sessions. Change the password in one of the two sessions and observe that the second session is not invalidated...

WWBN AVideo session id privilege escalation vulnerability

Talos Vulnerability Report TALOS-2022-1535 WWBN AVideo session id privilege escalation vulnerability August 16, 2022 CVE Number CVE-2022-30605 SUMMARY A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafte...

CVE-2022-2820

Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2...

CVE-2022-2820

Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2...

Session fixation

Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2...

CVE-2022-2820 Session Fixation in namelessmc/nameless

Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2...

CVE-2022-2820

CVE-2022-2820 affects NamelessMC (namelessmc/nameless) versions prior to 2.0.2. The vulnerability is a session fixation issue in the authentication/session handling, with root cause cited as improper session management prior to 2.0.2. Impact is described as elevated risk to user sessions (high co...

CVE-2022-2820 Session Fixation in namelessmc/nameless

Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2...

CVE-2022-2820 Session Fixation in namelessmc/nameless

Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2...

PT-2022-18869 · Nameless · Nameless

Name of the Vulnerable Software and Affected Versions: namelessmc/nameless versions prior to 2.0.2 Description: The issue concerns a session fixation problem. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...

Session fixation

Non-random values for ticketageadd in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption...

CVE-2022-33927

Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...

CVE-2022-33927

Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...

Session fixation

Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...

CVE-2022-33927

Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session...

CVE-2022-33927

Dell Wyse Management Suite 3.6.1 and earlier is affected by a Session Fixation vulnerability (CVE-2022-33927). An unauthenticated attacker can hijack a user session by exploiting a user with multiple active sessions. The issue is documented across multiple sources, including Nessus DSA-2022-134, ...

PT-2022-21916 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions 3.6.1 and below Description: The issue allows an unauthenticated attacker to exploit a Session Fixation vulnerability by taking advantage of a user with multiple active sessions, potentially hijacking a...

Session fixation

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

Nortek Linear eMerge E3-Series Account Takeover XSS Vulnerability

Nortek Linear eMerge E3-Series version 0.32-07p suffers from a vulnerability where session fixation tied with cross site scripting can allow for account takeover. Exploit Title: Nortek Linear eMerge E3-Series - Account Take Over Exploit Author: Omar Hashim Version: 0.32-07p Vendor home page:...

Nortek Linear eMerge E3-Series Account Takeover

Exploit Title: Nortek Linear eMerge E3-Series - Account Take Over Exploit Author: Omar Hashim Version: 0.32-07p Vendor home page: https://www.nortekcontrol.com/access-control/ Vendor home page: https://linear-solutions.com/ Authentication Required: No CVE: CVE-2022-31798 Description...