Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:05:14 +0000 EUVD-2026-337123 https://cve.radiocsirt.org/vuln/euvd-2026-337123 EUVD-2026-337123 https://cve.radiocsirt.org/vuln/euvd-2026-337123 fkie_cve-2024-23679 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23679 <p>Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.</p> <p>Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-23679 GHSA-4m5p-5w5w-3jcf — com.enonic.xp:lib-auth vulnerable to Session Fixation https://cve.radiocsirt.org/vuln/ghsa-4m5p-5w5w-3jcf <p><strong>Affected:</strong> Maven: com.enonic.xp:lib-auth</p> <p>### Impact All id-providers using lib-auth `login` method.</p> <p>### Patches https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4</p> <p>### Workarounds Don&#39;t use lib-auth for `login`. Java API uses low-level structures and allows to invalidate previous session before auth-info is added.</p> <p>### References</p> <p>https://github.com/enonic/xp/issues/9253</p> <p><strong>Affected:</strong> Maven: com.enonic.xp:lib-auth</p> <p>### Impact All id-providers using lib-auth `login` method.</p> <p>### Patches https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4</p> <p>### Workarounds Don&#39;t use lib-auth for `login`. Java API uses low-level structures and allows to invalidate previous session before auth-info is added.</p> <p>### References</p> <p>https://github.com/enonic/xp/issues/9253</p> https://cve.radiocsirt.org/vuln/ghsa-4m5p-5w5w-3jcf gsd-2024-23679 https://cve.radiocsirt.org/vuln/gsd-2024-23679 gsd-2024-23679 https://cve.radiocsirt.org/vuln/gsd-2024-23679