CWE-384 · Session Fixation (page 3)
Page 3 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40630 | Medium | 6.5 | 2022-09-23 | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to im… |
CVE-2022-3269 | Critical | 9.8 | 2022-09-23 | Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. |
CVE-2022-38369 | High | 8.8 | 2022-09-05 | Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue. |
CVE-2022-38054 | Critical | 9.8 | 2022-09-02 | In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation. |
CVE-2022-31798 | Medium | 6.1 | 2022-08-25 | Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained… |
CVE-2022-2997 | High | 8.0 | 2022-08-25 | Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-30605 | High | 8.8 | 2022-08-22 | A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP reques… |
CVE-2022-2820 | High | 7.0 | 2022-08-15 | Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2. |
CVE-2022-33927 | Medium | 5.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a us… |
CVE-2022-34536 | High | 7.5 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token. |
CVE-2022-22681 | High | 8.1 | 2022-07-06 | Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint… |
CVE-2022-25896 | Medium | 4.8 | 2022-07-01 | This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed. |
CVE-2022-24444 | Medium | 6.5 | 2022-06-28 | Silverstripe silverstripe/framework through 4.10 allows Session Fixation. |
CVE-2022-27305 | High | 8.8 | 2022-05-25 | Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation. |
CVE-2022-1849 | Medium | 5.4 | 2022-05-24 | Session Fixation in GitHub repository filegator/filegator prior to 7.8.0. |
CVE-2021-38869 | Critical | 9.8 | 2022-04-27 | IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. IBM X-Force ID: 208341. |
CVE-2020-25152 | Medium | 6.5 | 2022-04-14 | A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Ve… |
CVE-2022-26591 | High | 7.5 | 2022-04-06 | FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request. |
CVE-2022-24781 | High | 7.1 | 2022-03-24 | Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through th… |
CVE-2022-24745 | Medium | 4.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared betwe… |
CVE-2021-39066 | High | 8.8 | 2022-02-02 | IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated se… |
CVE-2022-22551 | High | 8.3 | 2022-01-21 | DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this… |
CVE-2021-20151 | Critical | 10.0 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions base… |
CVE-2021-31745 | High | 7.5 | 2021-12-10 | Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not… |
CVE-2021-41246 | Medium | 4.6 | 2021-12-09 | Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not re… |
CVE-2021-41268 | Medium | 6.5 | 2021-11-24 | Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rew… |
CVE-2021-42073 | High | 8.2 | 2021-11-08 | An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation… |
CVE-2021-41553 | Critical | 9.8 | 2021-10-05 | In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by an… |
CVE-2021-35948 | Medium | 5.4 | 2021-09-07 | Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can for… |
CVE-2021-22237 | Medium | 6.6 | 2021-08-25 | Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability… |
CVE-2021-39290 | Critical | 9.8 | 2021-08-23 | Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB8… |
CVE-2021-22927 | High | 8.1 | 2021-08-05 | A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijac… |
CVE-2021-2351 | High | 8.3 | 2021-07-21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Diffi… |
CVE-2021-32710 | Medium | 5.9 | 2021-06-24 | Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current… |
CVE-2021-35046 | Medium | 6.1 | 2021-06-22 | A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie. |
CVE-2010-1434 | High | 7.5 | 2021-06-21 | Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive info… |
CVE-2021-32676 | Medium | 6.5 | 2021-06-16 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11… |
CVE-2021-33394 | Medium | 5.4 | 2021-05-27 | Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create… |
CVE-2018-16495 | High | 8.8 | 2021-05-26 | In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into… |
CVE-2020-35229 | High | 8.8 | 2021-03-10 | The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused u… |
CVE-2019-18946 | Medium | 4.8 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation. |
CVE-2020-35591 | Medium | 5.4 | 2021-02-18 | Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is ab… |
CVE-2020-4954 | Medium | 5.4 | 2021-02-15 | IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation… |
CVE-2020-5021 | Medium | 4.4 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user o… |
CVE-2020-25198 | High | 8.8 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allo… |
CVE-2020-4555 | Medium | 5.4 | 2020-12-21 | IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user… |
CVE-2020-5645 | High | 7.5 | 2020-11-06 | Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earl… |
CVE-2020-5654 | High | 7.5 | 2020-11-02 | Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits… |
CVE-2019-4563 | Medium | 5.3 | 2020-10-29 | IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie value… |
CVE-2020-15909 | High | 8.8 | 2020-10-19 | SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not… |
CVE-2020-10714 | High | 7.5 | 2020-09-23 | A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker c… |
CVE-2020-6302 | High | 8.1 | 2020-09-09 | SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get… |
CVE-2020-4243 | Low | 3.7 | 2020-08-05 | IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle… |
CVE-2020-4527 | Medium | 5.9 | 2020-07-20 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie i… |
CVE-2020-6290 | Medium | 6.3 | 2020-07-14 | SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID. |
CVE-2019-4591 | High | 7.8 | 2020-07-13 | IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system… |
CVE-2020-5596 | High | 7.5 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-15018 | Medium | 6.5 | 2020-06-24 | playSMS through 1.4.3 is vulnerable to session fixation. |
CVE-2020-4229 | High | 7.3 | 2020-06-05 | IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain u… |
CVE-2020-13229 | High | 8.8 | 2020-06-02 | An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication t… |
CVE-2020-8434 | Critical | 9.8 | 2020-05-19 | Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a determ… |
CVE-2020-12258 | Critical | 9.1 | 2020-05-18 | rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Als… |
CVE-2020-1993 | Low | 3.7 | 2020-05-13 | The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an at… |
CVE-2020-5894 | High | 8.1 | 2020-05-07 | On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. |
CVE-2020-12467 | Medium | 6.5 | 2020-04-29 | Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie. |
CVE-2020-1762 | High | 7.0 | 2020-04-27 | An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could… |
CVE-2020-6824 | Low | 2.8 | 2020-04-24 | Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequ… |
CVE-2020-11729 | Critical | 9.8 | 2020-04-15 | An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not… |
CVE-2020-11728 | High | 7.5 | 2020-04-15 | An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone… |
CVE-2020-8826 | High | 7.5 | 2020-04-08 | As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—… |
CVE-2020-4291 | Medium | 4.3 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insuffic… |
CVE-2020-5550 | High | 8.1 | 2020-04-08 | Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to impersonate a regist… |
CVE-2020-5290 | Medium | 6.5 | 2020-04-01 | In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify… |
CVE-2019-19610 | Medium | 5.4 | 2020-03-16 | An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0. |
CVE-2019-4617 | Medium | 4.4 | 2020-03-16 | IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnera… |
CVE-2020-5543 | Critical | 9.8 | 2020-03-16 | TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions… |
CVE-2020-9370 | Critical | 9.1 | 2020-03-05 | HUMAX HGA12R-02 BRGCAA 1.1.53 devices allow Session Hijacking. |
CVE-2020-8990 | Critical | 9.1 | 2020-02-20 | Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. |
CVE-2014-10400 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary… |
CVE-2014-10399 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability… |
CVE-2013-4572 | High | 7.5 | 2020-02-06 | The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies… |
CVE-2013-0507 | High | 8.1 | 2020-02-05 | IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability |
CVE-2019-15612 | Medium | 5.9 | 2020-02-04 | A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. |
CVE-2020-5205 | Medium | 6.5 | 2020-01-09 | In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is use… |
CVE-2019-10158 | Critical | 9.8 | 2020-01-02 | A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration ca… |
CVE-2019-17563 | High | 7.5 | 2019-12-23 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could per… |
CVE-2019-18573 | High | 8.8 | 2019-12-18 | The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authent… |
CVE-2019-8116 | High | 7.5 | 2019-11-05 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated… |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2010-3671 | Medium | 6.5 | 2019-11-05 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijac… |
CVE-2019-17062 | High | 8.8 | 2019-11-05 | An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Editi… |
CVE-2019-18418 | Critical | 9.8 | 2019-10-24 | clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management. |
CVE-2019-15849 | High | 7.3 | 2019-10-17 | eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the s… |
CVE-2019-0062 | High | 7.5 | 2019-10-09 | A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web s… |
CVE-2019-4227 | High | 7.3 | 2019-10-04 | IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixatio… |
CVE-2019-4304 | Medium | 6.3 | 2019-09-30 | IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID… |
CVE-2019-6161 | High | 7.5 | 2019-09-26 | An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware version… |
CVE-2019-12203 | Medium | 6.3 | 2019-09-25 | SilverStripe through 4.3.3 allows session fixation in the "change password" form. |
CVE-2019-13517 | High | 8.8 | 2019-09-06 | In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified whe… |
CVE-2019-12258 | High | 7.5 | 2019-08-09 | Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP o… |