CWE-384 · Session Fixation (page 2)
Page 2 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56733 | Medium | 5.7 | 2024-12-30 | Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior… |
CVE-2024-28144 | Medium | 5.5 | 2024-12-12 | An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session managem… |
CVE-2024-50339 | Medium | 5.3 | 2024-12-12 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the s… |
CVE-2024-11317 | Critical | 10.0 | 2024-12-05 | Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. … |
CVE-2021-3740 | Medium | 6.8 | 2024-11-15 | A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices wh… |
CVE-2023-52268 | Critical | 9.1 | 2024-11-12 | The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to… |
CVE-2023-50176 | High | 7.5 | 2024-11-12 | A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized cod… |
CVE-2024-10318 | Medium | 5.4 | 2024-11-06 | A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an… |
CVE-2024-23590 | Critical | 9.1 | 2024-11-04 | Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or… |
CVE-2024-48929 | Medium | 4.2 | 2024-10-22 | Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8… |
CVE-2024-10158 | Medium | 4.3 | 2024-10-19 | A vulnerability classified as problematic has been found in PHPGurukul Boat Booking System 1.0. Affected is the function session_start. The manipulation leads… |
CVE-2024-8643 | Critical | 9.8 | 2024-09-27 | Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0. |
CVE-2024-45368 | High | 8.8 | 2024-09-13 | The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed ano… |
CVE-2024-42345 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2). The affected application does not properly handle user session e… |
CVE-2024-7341 | High | 7.1 | 2024-09-09 | A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even whe… |
CVE-2023-38018 | Medium | 6.3 | 2024-08-12 | IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the sys… |
CVE-2024-37829 | High | 8.8 | 2024-07-09 | An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link. |
CVE-2024-38513 | Critical | 10.0 | 2024-07-01 | Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions… |
CVE-2024-24552 | High | 8.8 | 2024-06-24 | A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into a… |
CVE-2024-25977 | High | 7.3 | 2024-05-29 | The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e… |
CVE-2023-30307 | Medium | 5.3 | 2024-05-28 | An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R476G routers allows… |
CVE-2024-23193 | Medium | 5.3 | 2024-05-06 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node… |
CVE-2023-38002 | Medium | 5.0 | 2024-04-30 | IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force… |
CVE-2024-2260 | Medium | 4.2 | 2024-04-16 | A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This… |
CVE-2024-0157 | Medium | 5.9 | 2024-04-12 | Dell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in SRM Windows Host Agent. An adjacent network unauthenticated at… |
CVE-2024-30262 | Medium | 5.9 | 2024-04-09 | Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the passwor… |
CVE-2024-31221 | Medium | 5.9 | 2024-04-08 | Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI int… |
CVE-2024-2639 | Medium | 4.3 | 2024-03-19 | A vulnerability was found in Bdtask Wholesale Inventory Management System up to 20240311. It has been declared as problematic. Affected by this vulnerability i… |
CVE-2024-28197 | High | 7.5 | 2024-03-11 | Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie wa… |
CVE-2024-22250 | High | 7.8 | 2024-02-20 | Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows ope… |
CVE-2023-50270 | Medium | 6.5 | 2024-02-20 | Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to ver… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2024-22318 | Medium | 5.1 | 2024-02-09 | IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modif… |
CVE-2023-47798 | Medium | 5.4 | 2024-02-08 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions do… |
CVE-2024-24823 | Medium | 5.7 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session… |
CVE-2023-50941 | Medium | 6.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using sessi… |
CVE-2023-52353 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last con… |
CVE-2024-23679 | Critical | 9.8 | 2024-01-19 | Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of… |
CVE-2023-50920 | Medium | 5.5 | 2024-01-12 | An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session id… |
CVE-2024-0351 | Low | 3.1 | 2024-01-09 | A vulnerability classified as problematic has been found in SourceCodester Engineers Online Portal 1.0. This affects an unknown part. The manipulation leads to… |
CVE-2023-6913 | High | 8.1 | 2023-12-19 | A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack… |
CVE-2023-49804 | Medium | 6.7 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logge… |
CVE-2023-48929 | Critical | 9.8 | 2023-12-08 | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resour… |
CVE-2022-46480 | High | 8.1 | 2023-12-05 | Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to s… |
CVE-2023-46733 | Medium | 6.5 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5… |
CVE-2023-5309 | Medium | 6.8 | 2023-11-07 | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. |
CVE-2023-0897 | High | 8.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session be… |
CVE-2023-45687 | High | 8.8 | 2023-10-16 | A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's a… |
CVE-2023-44400 | Medium | 6.7 | 2023-10-09 | Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is cau… |
CVE-2023-42322 | Critical | 9.8 | 2023-09-20 | Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information. |
CVE-2022-3916 | Medium | 6.8 | 2023-09-20 | A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due t… |
CVE-2023-3711 | Medium | 6.4 | 2023-09-12 | Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issu… |
CVE-2023-41012 | Critical | 9.8 | 2023-09-05 | An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authenticat… |
CVE-2023-4649 | Medium | 5.4 | 2023-08-31 | Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-40273 | High | 8.0 | 2023-08-23 | The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by… |
CVE-2023-24477 | High | 7.0 | 2023-08-09 | In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the… |
CVE-2023-21239 | Medium | 5.5 | 2023-07-13 | In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could lead to local informa… |
CVE-2023-21238 | Medium | 5.5 | 2023-07-13 | In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could lead to local information disclosure wi… |
CVE-2023-37946 | High | 8.8 | 2023-07-12 | Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. |
CVE-2023-34656 | High | 8.8 | 2023-06-29 | An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackers to gain escalated… |
CVE-2023-3394 | Medium | 5.4 | 2023-06-23 | Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. |
CVE-2023-34156 | Medium | 5.3 | 2023-06-19 | Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied. |
CVE-2023-28809 | High | 7.5 | 2023-06-15 | Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in… |
CVE-2023-3192 | Medium | 5.4 | 2023-06-11 | Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. |
CVE-2023-32997 | High | 8.8 | 2023-05-16 | Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. |
CVE-2023-31498 | Critical | 9.8 | 2023-05-11 | A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensiti… |
CVE-2023-28316 | Critical | 9.8 | 2023-05-09 | A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon act… |
CVE-2023-30056 | High | 7.5 | 2023-05-09 | A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie. |
CVE-2023-1265 | Medium | 5.4 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions s… |
CVE-2023-29020 | Medium | 6.5 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fas… |
CVE-2023-29019 | High | 8.1 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user… |
CVE-2023-2105 | High | 8.8 | 2023-04-15 | Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-26260 | Medium | 5.4 | 2023-04-11 | OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attacker, due to an impr… |
CVE-2022-31888 | High | 8.8 | 2023-04-05 | Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. |
CVE-2023-27490 | High | 8.1 | 2023-03-09 | NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have be… |
CVE-2021-36394 | Critical | 9.8 | 2023-03-06 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
CVE-2021-42761 | Critical | 9.0 | 2023-02-16 | A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6… |
CVE-2022-24895 | Medium | 6.3 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the… |
CVE-2023-24456 | Critical | 9.8 | 2023-01-26 | Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. |
CVE-2023-24427 | Critical | 9.8 | 2023-01-26 | Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. |
CVE-2023-24424 | High | 8.8 | 2023-01-26 | Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2021-29368 | High | 8.8 | 2023-01-20 | Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitra… |
CVE-2023-22479 | High | 7.5 | 2023-01-10 | KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible… |
CVE-2014-125048 | Medium | 6.3 | 2023-01-06 | A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oau… |
CVE-2022-43529 | Medium | 4.6 | 2023-01-05 | A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a… |
CVE-2022-36437 | Critical | 9.1 | 2022-12-29 | The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity o… |
CVE-2022-44017 | High | 7.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after t… |
CVE-2020-15679 | High | 7.6 | 2022-12-22 | An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that… |
CVE-2022-38628 | Medium | 6.1 | 2022-12-13 | Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS)… |
CVE-2022-4231 | Medium | 4.2 | 2022-11-30 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the… |
CVE-2022-44788 | Medium | 6.5 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that is issued by the serv… |
CVE-2022-44007 | High | 8.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users in… |
CVE-2022-30769 | Medium | 4.6 | 2022-11-15 | Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user. |
CVE-2022-43687 | Medium | 5.4 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by u… |
CVE-2022-31689 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authen… |
CVE-2022-43398 | High | 7.5 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-40293 | Critical | 9.8 | 2022-10-31 | The application was vulnerable to a session fixation that could be used hijack accounts. |
CVE-2021-46279 | Medium | 5.8 | 2022-10-24 | Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: L… |
CVE-2022-40226 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P8… |
CVE-2022-34334 | Medium | 6.5 | 2022-10-10 | IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the… |