Session fixation

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation...

CVE-2017-18105

The CVE affects Atlassian Crowd: versions before 3.0.2 and in 3.1.0–3.1.1 are vulnerable due to a session fixation flaw where the login flow does not rotate the JSESSIONID. This allows remote attackers who already possess a user’s JSESSIONID to access some built-in and potentially third-party RES...

CVE-2017-18105

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation...

Session fixation

An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices. There is unauthorized access to the WEB-UI by attackers arriving from the same source IP address as an authenticated user, because this IP address is used as a session...

Debian: Security Advisory (DLA-1707-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Session fixation

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability...

CloudBees Jenkins GitHub Authentication Plugin Session Fixation Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . GitHub Authentication Plugin is used in which ...

Session fixation

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

CVE-2019-7747

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

CVE-2019-7747

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

CVE-2019-7747

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

CVE-2019-7747

CVE-2019-7747 affects DbNinja 3.2.7 and enables session fixation through the data.php sessid parameter. The issue’s root cause is the use of a data.php sessid token that can allow an attacker to establish or hijack a user session. Public references indicate the vulnerability exists, with NVD noti...

Session fixation

A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session...

Session fixation

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

CVE-2019-1003019

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

CVE-2019-1003019

Summary: CVE-2019-1003019 affects the Jenkins GitHub Authentication Plugin (versions ≤ 0.29). The vulnerability lies in GithubSecurityRealm.java, enabling an attacker who can control the pre-authentication session to impersonate another user (session fixation). Affected software: Jenkins GitHub A...

CVE-2019-1003019

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

PT-2019-11317 · Jenkins · Jenkins Gitlab Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Authentication Plugin versions 0.29 and earlier Description: A session fixation issue exists that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. This is due to a...

ZoneMinder < 1.34.0 Multiple Vulnerabilities

ZoneMinder is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoneminder:zoneminder"; if...

Session fixation

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658...