4068 matches found
CVE-2017-1000150
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks...
CVE-2017-1000150
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks...
CVE-2017-1000150
CVE-2017-1000150 affects Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3. The root cause is that session IDs are not regenerated on login or logout, enabling session fixation. Impact is elevated risk of session hijacking for users of affected versions. Remediation: upgrade to Mahara 15.04.7 ...
Debian DLA-1145-1 : zoneminder security update
Multiple vulnerabilities have been found in zoneminder. This update fixes only a serious file disclosure vulnerability CVE-2017-5595. The application has been found to suffer from many other problems such as SQL injection vulnerabilities, cross-site scripting issues, cross-site request forgery,...
GHSA-JWHV-RGQC-FQJ5 Session fixation vulnerability in Rails
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...
GHSA-P4C6-77GC-694X session fixation protection mechanism in cgi_process.rb in Rails
The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...
session fixation protection mechanism in cgi_process.rb in Rails
The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...
Moderate severity vulnerability that affects rails
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...
Moderate severity vulnerability that affects rails
The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...
Airtame HDMI dongle session fixation vulnerability
The AIRTAME HDMI dongle is a wireless access point product for connecting, sharing and split-screen TVs or monitors. A security vulnerability exists in the /bin/login.php file of the Web Panel in the Airtame HDMI dongle using firmware versions prior to 3.0. The vulnerability can be exploited by a...
Session fixation
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user...
Session fixation
In X.Org Server aka xserver and xorg-server before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause aborts of the X server or replace shared memory segments of other X clients in the same session...
Session fixation
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session...
Cisco Prime LAN Management Solution Session Fixation Vulnerability
According to its self-reported version, the Cisco Prime LAN Management Solution LMS is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. C Tenable Network Security, Inc. include"compat.inc"; if description...
Cisco Prime LAN Management Solution Session Fixation Vulnerability
Cisco Prime LAN Management Solution LMS is a LAN-based network management solution from Cisco. The solution can configure, manage, monitor and maintain the network. A session fixation vulnerability exists in the networking functionality in Cisco Prime LMS, which originates when a program reuses a...
D-Link DIR-600L Session Fixed Vulnerability
D-Link DIR-600L is a cloud router product from AUO D-Link. A session fixation vulnerability exists in D-Link DIR-600L routers using firmware FW1.17.B01. A remote attacker can exploit the vulnerability to hijack a web session...
CVE-2017-12225
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...
CVE-2017-12225
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...
CVE-2017-12225
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...