5183 matches found
CVE-2022-24895: Session Fixation
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...
GHSA-3GV2-29QC-V67M Symfony vulnerable to Session Fixation of CSRF tokens
Description ----------- When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performin...
Symfony vulnerable to Session Fixation of CSRF tokens
Description ----------- When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performin...
PT-2023-1575 · Symfony +4 · Symfony +4
Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 4.4 Description: The issue is related to incorrect session management in Symfony, a PHP framework for web and console applications. When authenticating users, Symfony by default regenerates the session ID upon login...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
Session fixation
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402: Improper Authentication
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
PT-2023-11550
Name of the Vulnerable Software and Affected Versions Westbrookadmin portfolioCMS version 1.05 Description The issue allows attackers to bypass password validation and access sensitive information via session fixation. Recommendations For Westbrookadmin portfolioCMS version 1.05, update to a...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation...
CVE-2020-20402
CVE-2020-20402 affects Westbrookadmin portfolioCMS v1.05. The vulnerability enables bypassing password validation and unauthorized access to sensitive information via session fixation. Impact is defined as Confidentiality High with no integrity/availability impact reported; CVSS 3.1 base score 7....
portfolioCMS 授权问题漏洞
portfolioCMS is Bootstrap portfolio website with admin panel. A security vulnerability exists in Westbrookadmin portfolioCMS v1.05. An attacker could exploit the vulnerability to bypass password authentication and gain access to sensitive information via session fixation...
Session Fixation in https://demo.froxlor.org/
Description The session ID not rotating even after relogin POC 1. Change the PHPSESSID=newsessionchanged and then login 2. Use the same session into new browser and as you can see logged into the account 3. you can try logout and login again the PHPSESSID doesn't change. Video POC:...
Session Fixation
github.com/rancher/rancher is vulnerable to Session Fixation. The vulnerability exists because the library does not properly revoke the generated token after modification is made to the authentication provider, allowing an attacker to retain access to Rancher and the kubectl cluster...
GHSA-F976-24HC-MJVR Session fixation vulnerability in Jenkins OpenID Plugin
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login...
GHSA-9963-GMH8-VVM6 Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...