CWE-384 Archives - CVE Vulnerability

CVE-2008-3222

Sun, 26 Feb 2023 09:09:54 +0000

Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules “terminate the current request during a login event,” allows remote attackers to hijack web sessions via unknown vectors.

The post CVE-2008-3222 appeared first on CVE Vulnerability.

CVE-2007-4188

Sun, 26 Feb 2023 09:07:06 +0000

Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unspecified vectors.

The post CVE-2007-4188 appeared first on CVE Vulnerability.

CVE-2018-9082

Sun, 26 Feb 2023 06:51:43 +0000

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user’s current password to set a new one. As a result, attackers with access to the user’s session tokens can change their password and retain access to the user’s account

The post CVE-2018-9082 appeared first on CVE Vulnerability.

CVE-2018-9026

Sun, 26 Feb 2023 06:51:42 +0000

A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.

The post CVE-2018-9026 appeared first on CVE Vulnerability.

CVE-2018-8852

Sun, 26 Feb 2023 06:51:37 +0000

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives an attacker the opportunity to steal authenticated sessions without invalidating any existing session identifier.

The post CVE-2018-8852 appeared first on CVE Vulnerability.

CVE-2018-6959

Sun, 26 Feb 2023 06:50:53 +0000

VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user’s session.

The post CVE-2018-6959 appeared first on CVE Vulnerability.

CVE-2018-6434

Sun, 26 Feb 2023 06:50:42 +0000

A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user’s session ID.

The post CVE-2018-6434 appeared first on CVE Vulnerability.

CVE-2018-5465

Sun, 26 Feb 2023 06:50:21 +0000

A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fixation vulnerability in the web interface has been identified, which may allow an attacker to hijack web sessions.

The post CVE-2018-5465 appeared first on CVE Vulnerability.

CVE-2018-5385

Sun, 26 Feb 2023 06:50:19 +0000

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.

The post CVE-2018-5385 appeared first on CVE Vulnerability.

CVE-2018-2408

Sun, 26 Feb 2023 06:49:00 +0000

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active.

The post CVE-2018-2408 appeared first on CVE Vulnerability.