Apache Tomcat 7.0.x < 7.0.99 Session Fixation

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 or 7.0.0 to 7.0.98. It is, therefore, affected by a session fixation vulnerability when using FORM authentication. Note that the scanner has not attempted to exploit these issues but has instead relie...

Apache Tomcat 9.0.0.M1 < 9.0.30 Session Fixation

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 or 7.0.0 to 7.0.98. It is, therefore, affected by a session fixation vulnerability when using FORM authentication. Note that the scanner has not attempted to exploit these issues but has instead relie...

Nord Security: Arbitrary Set-Cookie via "?coupon=" due to semi-colon not encoded

Related to , the separator in the cookie header is semi-colon ; and this issue is caused by semicolon ; not encoded, so the attacker can arbitrarily manipulate cookies. Arbitrary set cookie will cause several problems like: - Session Fixation - Cookie Bomb Client-Side DoS - Etc Vulnerable Endpoin...

EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2020-1182)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker...

Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2020-1182)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Session Fixation

infinispan-spring5-common is vulnerable to session fixation. An improper implementation of the session cookie creation and deletion allows an attacker to gain unauthorized access to the application...

EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2020-1136)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker...

Session fixation

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2020-8990

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation...

CVE-2020-8990

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation...

CVE-2020-8990

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation...

Session fixation

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation...

CVE-2020-8990

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation...

CVE-2020-8990

CVE-2020-8990 affects Western Digital My Cloud Home and ibi prior to 3.6.0, where a session fixation issue is present. The connected records confirm the affected products and versions, identifying the vulnerability type as session fixation but do not provide implementation details, exploit steps,...

CVE-2020-8990: Session Fixation

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation...

PT-2020-20413

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Home versions prior to 3.6.0 ibi versions prior to 3.6.0 Description The issue allows Session Fixation. Recommendations For Western Digital My Cloud Home versions prior to 3.6.0, update to version 3.6.0 or later. For i...

CVE-2014-10400: Session Fixation

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

CVE-2014-10399: Session Fixation

The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

CVE-2013-4572: Session Fixation

The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user...

Session fixation

IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...