CVE-2023-25170

PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery CSRF. When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to...

Cross site request forgery (csrf)

PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery CSRF. When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to...

CVE-2023-25170 PrestaShop has possible CSRF token fixation

PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery CSRF. When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to...

CVE-2023-25170

PrestaShop prior to version 8.0.1 is vulnerable to Cross-site request forgery (CSRF) due to CSRF tokens not being cleared on login, allowing potential session-fixation-like attacks by attackers with network access. Affected component is the authentication/session management flow; root cause is to...

CVE-2023-25170

PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery CSRF. When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to...

CVE-2023-25170: Cross-Site Request Forgery (CSRF)

PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery CSRF. When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to...

PrestaShop 跨站请求伪造漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A cross-site request forgery vulnerability exists in PrestaShop versions prior to 8.0.1 that stems from the...

CVE-2023-27490: Session Fixation

NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social...

Debian: Security Advisory (DSA-2115-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moodle Session Fixation vulnerability

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin...

GHSA-2563-FP9C-MGM8 Moodle Session Fixation vulnerability

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin...

FortiWeb web applications Session Fixation

The vulnerability of FortiWeb web applications’ network firewalls is related to the lack of a session fixation mechanism. Exploiting this vulnerability allows a malicious actor to intercept sessions of other users remotely...

CVE-2021-36394: Session Fixation

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin...

Session fixation

An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account...

K14930: PHP vulnerability CVE-2011-4718

Security Advisory Description Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. CVE-2011-4718 Impact None Security Advisory Status To determine if your release is known to be vulnerable, the...

K20038622: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2013-1976 The 1 tomcat5, 2 tomcat6, and 3 tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a...

K41190253: Multiple RTOS vulnerabilities

Security Advisory Description CVE-2019-12255 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the TCP component issue 1 of 4. This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow. CVE-2019-12256 Wind River VxWorks 6.9 and vx7 has a Buffer...

K24551552: Apache Tomcat vulnerability CVE-2019-17563

Security Advisory Description When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but,...

K51025324: Apache Tomcat 7.x vulnerabilities CVE-2015-5346, CVE-2015-5351, and CVE-2016-0763

Security Advisory Description CVE-2015-5346 Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to...

Session fixation

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access...