CWE-384 · Session Fixation (page 3)
Page 3 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36394 | Critical | 9.8 | 2023-03-06 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
CVE-2021-42761 | Critical | 9.0 | 2023-02-16 | A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6… |
CVE-2022-24895 | Medium | 6.3 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the… |
CVE-2023-24456 | Critical | 9.8 | 2023-01-26 | Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. |
CVE-2023-24427 | Critical | 9.8 | 2023-01-26 | Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. |
CVE-2023-24424 | High | 8.8 | 2023-01-26 | Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2021-29368 | High | 8.8 | 2023-01-20 | Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitra… |
CVE-2023-22479 | High | 7.5 | 2023-01-10 | KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible… |
CVE-2014-125048 | Medium | 6.3 | 2023-01-06 | A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oau… |
CVE-2022-43529 | Medium | 4.6 | 2023-01-05 | A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a… |
CVE-2022-36437 | Critical | 9.1 | 2022-12-29 | The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity o… |
CVE-2022-44017 | High | 7.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after t… |
CVE-2020-15679 | High | 7.6 | 2022-12-22 | An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that… |
CVE-2022-38628 | Medium | 6.1 | 2022-12-13 | Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS)… |
CVE-2022-4231 | Medium | 4.2 | 2022-11-30 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the… |
CVE-2022-44788 | Medium | 6.5 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that is issued by the serv… |
CVE-2022-44007 | High | 8.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users in… |
CVE-2022-30769 | Medium | 4.6 | 2022-11-15 | Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user. |
CVE-2022-43687 | Medium | 5.4 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by u… |
CVE-2022-31689 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authen… |
CVE-2022-43398 | High | 7.5 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-40293 | Critical | 9.8 | 2022-10-31 | The application was vulnerable to a session fixation that could be used hijack accounts. |
CVE-2021-46279 | Medium | 5.8 | 2022-10-24 | Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: L… |
CVE-2022-40226 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P8… |
CVE-2022-34334 | Medium | 6.5 | 2022-10-10 | IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the… |
CVE-2022-40630 | Medium | 6.5 | 2022-09-23 | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to im… |
CVE-2022-3269 | Critical | 9.8 | 2022-09-23 | Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. |
CVE-2022-38369 | High | 8.8 | 2022-09-05 | Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue. |
CVE-2022-38054 | Critical | 9.8 | 2022-09-02 | In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation. |
CVE-2022-31798 | Medium | 6.1 | 2022-08-25 | Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained… |
CVE-2022-2997 | High | 8.0 | 2022-08-25 | Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-30605 | High | 8.8 | 2022-08-22 | A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP reques… |
CVE-2022-2820 | High | 7.0 | 2022-08-15 | Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2. |
CVE-2022-33927 | Medium | 5.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a us… |
CVE-2022-34536 | High | 7.5 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token. |
CVE-2022-22681 | High | 8.1 | 2022-07-06 | Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint… |
CVE-2022-25896 | Medium | 4.8 | 2022-07-01 | This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed. |
CVE-2022-24444 | Medium | 6.5 | 2022-06-28 | Silverstripe silverstripe/framework through 4.10 allows Session Fixation. |
CVE-2022-27305 | High | 8.8 | 2022-05-25 | Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation. |
CVE-2022-1849 | Medium | 5.4 | 2022-05-24 | Session Fixation in GitHub repository filegator/filegator prior to 7.8.0. |
CVE-2021-38869 | Critical | 9.8 | 2022-04-27 | IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. IBM X-Force ID: 208341. |
CVE-2020-25152 | Medium | 6.5 | 2022-04-14 | A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Ve… |
CVE-2022-26591 | High | 7.5 | 2022-04-06 | FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request. |
CVE-2022-24781 | High | 7.1 | 2022-03-24 | Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through th… |
CVE-2022-24745 | Medium | 4.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared betwe… |
CVE-2021-39066 | High | 8.8 | 2022-02-02 | IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated se… |
CVE-2022-22551 | High | 8.3 | 2022-01-21 | DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this… |
CVE-2021-20151 | Critical | 10.0 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions base… |
CVE-2021-31745 | High | 7.5 | 2021-12-10 | Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not… |
CVE-2021-41246 | Medium | 4.6 | 2021-12-09 | Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not re… |
CVE-2021-41268 | Medium | 6.5 | 2021-11-24 | Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rew… |
CVE-2021-42073 | High | 8.2 | 2021-11-08 | An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation… |
CVE-2021-41553 | Critical | 9.8 | 2021-10-05 | In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by an… |
CVE-2021-35948 | Medium | 5.4 | 2021-09-07 | Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can for… |
CVE-2021-22237 | Medium | 6.6 | 2021-08-25 | Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability… |
CVE-2021-39290 | Critical | 9.8 | 2021-08-23 | Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB8… |
CVE-2021-22927 | High | 8.1 | 2021-08-05 | A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijac… |
CVE-2021-2351 | High | 8.3 | 2021-07-21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Diffi… |
CVE-2021-32710 | Medium | 5.9 | 2021-06-24 | Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current… |
CVE-2021-35046 | Medium | 6.1 | 2021-06-22 | A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie. |
CVE-2010-1434 | High | 7.5 | 2021-06-21 | Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive info… |
CVE-2021-32676 | Medium | 6.5 | 2021-06-16 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11… |
CVE-2021-33394 | Medium | 5.4 | 2021-05-27 | Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create… |
CVE-2018-16495 | High | 8.8 | 2021-05-26 | In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into… |
CVE-2020-35229 | High | 8.8 | 2021-03-10 | The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused u… |
CVE-2019-18946 | Medium | 4.8 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation. |
CVE-2020-35591 | Medium | 5.4 | 2021-02-18 | Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is ab… |
CVE-2020-4954 | Medium | 5.4 | 2021-02-15 | IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation… |
CVE-2020-5021 | Medium | 4.4 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user o… |
CVE-2020-25198 | High | 8.8 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allo… |
CVE-2020-4555 | Medium | 5.4 | 2020-12-21 | IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user… |
CVE-2020-5645 | High | 7.5 | 2020-11-06 | Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earl… |
CVE-2020-5654 | High | 7.5 | 2020-11-02 | Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits… |
CVE-2019-4563 | Medium | 5.3 | 2020-10-29 | IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie value… |
CVE-2020-15909 | High | 8.8 | 2020-10-19 | SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not… |
CVE-2020-10714 | High | 7.5 | 2020-09-23 | A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker c… |
CVE-2020-6302 | High | 8.1 | 2020-09-09 | SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get… |
CVE-2020-4243 | Low | 3.7 | 2020-08-05 | IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle… |
CVE-2020-4527 | Medium | 5.9 | 2020-07-20 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie i… |
CVE-2020-6290 | Medium | 6.3 | 2020-07-14 | SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID. |
CVE-2019-4591 | High | 7.8 | 2020-07-13 | IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system… |
CVE-2020-5596 | High | 7.5 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-15018 | Medium | 6.5 | 2020-06-24 | playSMS through 1.4.3 is vulnerable to session fixation. |
CVE-2020-4229 | High | 7.3 | 2020-06-05 | IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain u… |
CVE-2020-13229 | High | 8.8 | 2020-06-02 | An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication t… |
CVE-2020-8434 | Critical | 9.8 | 2020-05-19 | Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a determ… |
CVE-2020-12258 | Critical | 9.1 | 2020-05-18 | rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Als… |
CVE-2020-1993 | Low | 3.7 | 2020-05-13 | The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an at… |
CVE-2020-5894 | High | 8.1 | 2020-05-07 | On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. |
CVE-2020-12467 | Medium | 6.5 | 2020-04-29 | Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie. |
CVE-2020-1762 | High | 7.0 | 2020-04-27 | An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could… |
CVE-2020-6824 | Low | 2.8 | 2020-04-24 | Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequ… |
CVE-2020-11729 | Critical | 9.8 | 2020-04-15 | An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not… |
CVE-2020-11728 | High | 7.5 | 2020-04-15 | An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone… |
CVE-2020-8826 | High | 7.5 | 2020-04-08 | As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—… |
CVE-2020-4291 | Medium | 4.3 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insuffic… |
CVE-2020-5550 | High | 8.1 | 2020-04-08 | Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to impersonate a regist… |
CVE-2020-5290 | Medium | 6.5 | 2020-04-01 | In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify… |
CVE-2019-19610 | Medium | 5.4 | 2020-03-16 | An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0. |
CVE-2019-4617 | Medium | 4.4 | 2020-03-16 | IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnera… |