CWE-384 · Session Fixation (page 2)
Page 2 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53021 | Medium | 4.2 | 2025-06-24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey… |
CVE-2024-13967 | High | 8.8 | 2025-06-04 | This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. … |
CVE-2025-46815 | High | 8.0 | 2025-05-06 | The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for… |
CVE-2025-45953 | Critical | 9.1 | 2025-04-28 | A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Imp… |
CVE-2025-45949 | Critical | 9.8 | 2025-04-28 | A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the… |
CVE-2025-42602 | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A rem… | |
CVE-2025-28242 | Critical | 9.8 | 2025-04-18 | Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack. |
CVE-2025-28238 | Critical | 9.8 | 2025-04-18 | Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack. |
CVE-2024-49709 | Medium | 4.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser mig… |
CVE-2025-0126 | | 2025-04-11 | When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and pe… | |
CVE-2025-29928 | High | 8.0 | 2025-03-28 | authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage… |
CVE-2025-26658 | Medium | 6.8 | 2025-03-11 | The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unaut… |
CVE-2025-27661 | Critical | 9.1 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004. |
CVE-2025-1412 | Low | 3.1 | 2025-02-24 | Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user t… |
CVE-2024-49344 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages with Watson Assistant chat feature enabled the application establishes a session when a user logs in an… |
CVE-2022-40916 | Critical | 9.8 | 2025-02-06 | Tiny File Manager v2.4.7 and below is vulnerable to session fixation. |
CVE-2024-42207 | Medium | 5.5 | 2025-02-05 | HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session. |
CVE-2025-22216 | Medium | 5.4 | 2025-01-31 | A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP… |
CVE-2025-24503 | | 2025-01-30 | A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. | |
CVE-2025-24502 | | 2025-01-30 | An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by… | |
CVE-2024-56529 | High | 7.1 | 2025-01-28 | Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on… |
CVE-2024-57052 | Critical | 9.8 | 2025-01-27 | An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file. |
CVE-2024-42171 | Medium | 6.4 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42170 | Medium | 6.8 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-13279 | Critical | 9.8 | 2025-01-09 | Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0… |
CVE-2024-56733 | Medium | 5.7 | 2024-12-30 | Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior… |
CVE-2024-28144 | Medium | 5.5 | 2024-12-12 | An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session managem… |
CVE-2024-50339 | Medium | 5.3 | 2024-12-12 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the s… |
CVE-2024-11317 | Critical | 10.0 | 2024-12-05 | Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. … |
CVE-2021-3740 | Medium | 6.8 | 2024-11-15 | A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices wh… |
CVE-2023-52268 | Critical | 9.1 | 2024-11-12 | The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to… |
CVE-2023-50176 | Medium | 4.2 | 2024-11-12 | A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute… |
CVE-2024-10318 | Medium | 5.4 | 2024-11-06 | A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an… |
CVE-2024-23590 | Critical | 9.1 | 2024-11-04 | Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or… |
CVE-2024-48929 | Medium | 4.2 | 2024-10-22 | Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8… |
CVE-2024-10158 | Medium | 4.3 | 2024-10-19 | A vulnerability classified as problematic has been found in PHPGurukul Boat Booking System 1.0. Affected is the function session_start. The manipulation leads… |
CVE-2024-8643 | Critical | 9.8 | 2024-09-27 | Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0. |
CVE-2024-45368 | High | 8.8 | 2024-09-13 | The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed ano… |
CVE-2024-42345 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2). The affected application does not properly handle user session e… |
CVE-2024-7341 | High | 7.1 | 2024-09-09 | A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even whe… |
CVE-2023-38018 | Medium | 6.3 | 2024-08-12 | IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the sys… |
CVE-2024-37829 | High | 8.8 | 2024-07-09 | An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link. |
CVE-2024-38513 | Critical | 10.0 | 2024-07-01 | Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions… |
CVE-2024-24552 | High | 8.8 | 2024-06-24 | A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into a… |
CVE-2024-25977 | High | 7.3 | 2024-05-29 | The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e… |
CVE-2023-30307 | Medium | 5.3 | 2024-05-28 | An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R476G routers allows… |
CVE-2024-23193 | Medium | 5.3 | 2024-05-06 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node… |
CVE-2023-38002 | Medium | 5.0 | 2024-04-30 | IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force… |
CVE-2024-2260 | Medium | 4.2 | 2024-04-16 | A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This… |
CVE-2024-0157 | Medium | 5.9 | 2024-04-12 | Dell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in SRM Windows Host Agent. An adjacent network unauthenticated at… |
CVE-2024-30262 | Medium | 5.9 | 2024-04-09 | Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the passwor… |
CVE-2024-31221 | Medium | 5.9 | 2024-04-08 | Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI int… |
CVE-2024-2639 | Medium | 4.3 | 2024-03-19 | A vulnerability was found in Bdtask Wholesale Inventory Management System up to 20240311. It has been declared as problematic. Affected by this vulnerability i… |
CVE-2024-28197 | High | 7.5 | 2024-03-11 | Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie wa… |
CVE-2024-22250 | High | 7.8 | 2024-02-20 | Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows ope… |
CVE-2023-50270 | Medium | 6.5 | 2024-02-20 | Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to ver… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2024-22318 | Medium | 5.1 | 2024-02-09 | IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modif… |
CVE-2023-47798 | Medium | 5.4 | 2024-02-08 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions do… |
CVE-2024-24823 | Medium | 5.7 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session… |
CVE-2023-50941 | Medium | 6.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using sessi… |
CVE-2023-52353 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last con… |
CVE-2024-23679 | Critical | 9.8 | 2024-01-19 | Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of… |
CVE-2023-50920 | Medium | 5.5 | 2024-01-12 | An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session id… |
CVE-2024-0351 | Low | 3.1 | 2024-01-09 | A vulnerability classified as problematic has been found in SourceCodester Engineers Online Portal 1.0. This affects an unknown part. The manipulation leads to… |
CVE-2023-6913 | High | 8.1 | 2023-12-19 | A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack… |
CVE-2023-49804 | Medium | 6.7 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logge… |
CVE-2023-48929 | Critical | 9.8 | 2023-12-08 | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resour… |
CVE-2022-46480 | High | 8.1 | 2023-12-05 | Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to s… |
CVE-2023-46733 | Medium | 6.5 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5… |
CVE-2023-5309 | Medium | 6.8 | 2023-11-07 | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. |
CVE-2023-0897 | High | 8.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session be… |
CVE-2023-45687 | High | 8.8 | 2023-10-16 | A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's a… |
CVE-2023-44400 | Medium | 6.7 | 2023-10-09 | Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is cau… |
CVE-2023-42322 | Critical | 9.8 | 2023-09-20 | Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information. |
CVE-2022-3916 | Medium | 6.8 | 2023-09-20 | A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due t… |
CVE-2023-3711 | Medium | 6.4 | 2023-09-12 | Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issu… |
CVE-2023-41012 | Critical | 9.8 | 2023-09-05 | An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authenticat… |
CVE-2023-4649 | Medium | 5.4 | 2023-08-31 | Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-40273 | High | 8.0 | 2023-08-23 | The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by… |
CVE-2023-24477 | High | 7.0 | 2023-08-09 | In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the… |
CVE-2023-21239 | Medium | 5.5 | 2023-07-13 | In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could lead to local informa… |
CVE-2023-21238 | Medium | 5.5 | 2023-07-13 | In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could lead to local information disclosure wi… |
CVE-2023-37946 | High | 8.8 | 2023-07-12 | Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. |
CVE-2023-34656 | High | 8.8 | 2023-06-29 | An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackers to gain escalated… |
CVE-2023-3394 | Medium | 5.4 | 2023-06-23 | Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. |
CVE-2023-34156 | Medium | 5.3 | 2023-06-19 | Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied. |
CVE-2023-28809 | High | 7.5 | 2023-06-15 | Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in… |
CVE-2023-3192 | Medium | 5.4 | 2023-06-11 | Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. |
CVE-2023-32997 | High | 8.8 | 2023-05-16 | Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. |
CVE-2023-31498 | Critical | 9.8 | 2023-05-11 | A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensiti… |
CVE-2023-28316 | Critical | 9.8 | 2023-05-09 | A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon act… |
CVE-2023-30056 | High | 7.5 | 2023-05-09 | A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie. |
CVE-2023-1265 | Medium | 5.4 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions s… |
CVE-2023-29020 | Medium | 6.5 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fas… |
CVE-2023-29019 | High | 8.1 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user… |
CVE-2023-2105 | High | 8.8 | 2023-04-15 | Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-26260 | Medium | 5.4 | 2023-04-11 | OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attacker, due to an impr… |
CVE-2022-31888 | High | 8.8 | 2023-04-05 | Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. |
CVE-2023-27490 | High | 8.1 | 2023-03-09 | NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have be… |