5183 matches found
Session fixation
Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access...
Session fixation
Protection mechanism failure in the IntelR Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access...
Session fixation
Protection mechanism failure in the IntelR Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access...
CVE-2021-42761
A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session...
Session fixation
A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session...
CVE-2021-42761
CVE-2021-42761 affects FortiWeb WAF session management. A session-fixation condition could allow a remote, unauthenticated attacker to infer other users’ session identifiers and potentially hijack sessions. Affected FortiWeb versions include 6.4 (all), 6.3.0–6.3.16, 6.2.0–6.2.6, 6.1.0–6.1.2, 6.0....
CVE-2021-42761
A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session...
Session Fixation
symfony is vulnerable to Session Fixation.The vulnerability exists due to the lack of validations in security.xml, which allows an attacker to gain unauthorized access to an account...
PT-2023-1548
Name of the Vulnerable Software and Affected Versions FortiWeb versions 5.9.0 through 5.9.1 FortiWeb versions 6.0.0 through 6.0.7 FortiWeb versions 6.1.0 through 6.1.2 FortiWeb versions 6.2.0 through 6.2.6 FortiWeb versions 6.3.0 through 6.3.16 FortiWeb versions 6.4 all versions Description A...
FortiWeb - Weak generation of WAF session IDs leads to session fixation
A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session...
CVE-2021-42761: Session Fixation
A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session...
SUSE CVE-2004-0746
Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session...
SUSE CVE-2007-4438
Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors...
SUSE CVE-2007-5380
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...
SUSE CVE-2007-6077
The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...
SUSE CVE-2009-1580
Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie...
SUSE CVE-2010-1613
Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks...
SUSE CVE-2011-0717
Session fixation vulnerability in Red Hat Network RHN Satellite Server 5.4 allows remote attackers to hijack web sessions via unspecified vectors related to Spacewalk...