Skip to content

Product

hex pow vulnerabilities

2 published CVES affecting hex pow, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest hex pow CVEs

Newest publication first

  1. CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

    Published
    MediumCVSS 6.5 EPSS 0.55%

    Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A...

  2. CVE-2020-5205 Session fixation attack in Pow (Hex package)

    Published
    MediumCVSS 5.4 EPSS 0.77%

    In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vuln...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.