CWE-384 · Session Fixation (page 4)
Page 4 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5406 | High | 7.2 | 2019-08-09 | A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5400 | Medium | 6.3 | 2019-08-09 | A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-10371 | High | 7.5 | 2019-08-07 | A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersona… |
CVE-2019-7849 | High | 7.5 | 2019-08-02 | A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2… |
CVE-2019-4439 | Medium | 5.3 | 2019-07-25 | IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IB… |
CVE-2019-10120 | High | 8.8 | 2019-07-10 | On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to… |
CVE-2019-4152 | Medium | 4.4 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attacker… |
CVE-2019-6584 | High | 8.8 | 2019-06-12 | A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy… |
CVE-2019-10045 | Medium | 6.5 | 2019-05-31 | The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access… |
CVE-2019-1807 | High | 7.6 | 2019-05-03 | A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access… |
CVE-2018-15208 | High | 7.5 | 2019-04-30 | BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter. |
CVE-2019-10008 | High | 8.8 | 2019-04-24 | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an est… |
CVE-2017-12619 | High | 8.1 | 2019-04-23 | Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone". |
CVE-2019-11213 | High | 8.1 | 2019-04-12 | In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthori… |
CVE-2015-5384 | High | 8.8 | 2019-04-03 | AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack. |
CVE-2018-1626 | Low | 3.1 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to sessio… |
CVE-2019-5523 | Critical | 9.8 | 2019-04-01 | VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. S… |
CVE-2017-18105 | High | 8.1 | 2019-03-29 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obt… |
CVE-2019-9744 | High | 8.8 | 2019-03-26 | An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices. There is unauthorized access to… |
CVE-2019-3784 | High | 8.2 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using… |
CVE-2019-3783 | High | 8.8 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brut… |
CVE-2018-1948 | Medium | 4.3 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session co… |
CVE-2019-0102 | High | 8.8 | 2019-02-18 | Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially en… |
CVE-2018-20238 | High | 8.1 | 2019-02-13 | Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expi… |
CVE-2019-7747 | Critical | 9.6 | 2019-02-11 | DbNinja 3.2.7 allows session fixation via the data.php sessid parameter. |
CVE-2019-1003019 | Medium | 5.9 | 2019-02-06 | An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attacker… |
CVE-2018-1962 | Medium | 4.0 | 2019-02-04 | IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session terminat… |
CVE-2019-7350 | High | 7.3 | 2019-02-04 | Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victi… |
CVE-2018-17199 | High | 7.5 | 2019-01-30 | In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to… |
CVE-2018-1000409 | Medium | 5.4 | 2019-01-09 | A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm… |
CVE-2018-1804 | Low | 3.7 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cook… |
CVE-2018-1485 | Low | 3.1 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session… |
CVE-2018-1484 | Low | 3.7 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be a… |
CVE-2018-1480 | Medium | 4.0 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Sit… |
CVE-2018-13337 | Medium | 5.4 | 2018-11-27 | Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript. |
CVE-2018-19443 | Medium | 5.9 | 2018-11-22 | The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc… |
CVE-2018-6434 | High | 7.5 | 2018-11-08 | A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipu… |
CVE-2018-18926 | Critical | 9.8 | 2018-11-04 | Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/ses… |
CVE-2018-18925 | Critical | 9.8 | 2018-11-04 | Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session… |
CVE-2018-13282 | Medium | 5.6 | 2018-10-31 | Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHP… |
CVE-2018-16463 | Low | 3.1 | 2018-10-30 | A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protecte… |
CVE-2018-18380 | Medium | 5.4 | 2018-10-19 | A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a us… |
CVE-2018-17902 | Medium | 5.3 | 2018-10-12 | Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The application utilizes multiple methods of session management whic… |
CVE-2018-9082 | High | 8.8 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does no… |
CVE-2018-8852 | High | 8.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives… |
CVE-2018-1127 | Medium | 4.2 | 2018-09-11 | Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few min… |
CVE-2017-1368 | Medium | 4.3 | 2018-08-06 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers… |
CVE-2016-8609 | Low | 3.7 | 2018-08-01 | It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from… |
CVE-2018-5385 | High | 8.8 | 2018-07-24 | Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authent… |
CVE-2016-9574 | Medium | 5.9 | 2018-07-19 | nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA. |
CVE-2018-14387 | High | 8.8 | 2018-07-18 | An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The… |
CVE-2016-6545 | Critical | 9.8 | 2018-07-13 | Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded… |
CVE-2018-1492 | Medium | 4.3 | 2018-07-10 | IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out fr… |
CVE-2018-1000602 | Medium | 5.9 | 2018-06-26 | A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate an… |
CVE-2018-1000519 | Medium | 6.5 | 2018-06-26 | aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/… |
CVE-2018-12538 | High | 8.8 | 2018-06-22 | In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is… |
CVE-2018-0359 | Medium | 5.5 | 2018-06-21 | A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenti… |
CVE-2018-9026 | High | 7.5 | 2018-06-18 | A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request. |
CVE-2018-12071 | Critical | 9.8 | 2018-06-17 | A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled. |
CVE-2017-3968 | High | 7.5 | 2018-06-13 | Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) b… |
CVE-2018-11385 | High | 8.1 | 2018-06-13 | An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x befo… |
CVE-2018-11714 | Critical | 9.8 | 2018-06-04 | An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622… |
CVE-2018-11571 | High | 8.8 | 2018-05-31 | ClipperCMS 1.3.3 allows Session Fixation. |
CVE-2018-11567 | Low | 3.3 | 2018-05-30 | Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa do… |
CVE-2018-1375 | Medium | 5.9 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could lead to session fixati… |
CVE-2018-11475 | High | 8.0 | 2018-05-25 | Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different… |
CVE-2018-11474 | High | 8.0 | 2018-05-25 | Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_id=1 does not inval… |
CVE-2018-1148 | Medium | 6.5 | 2018-05-18 | In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system… |
CVE-2018-10591 | Medium | 6.1 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10252 | High | 8.1 | 2018-05-14 | An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking… |
CVE-2018-1000173 | Medium | 5.9 | 2018-05-08 | A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to i… |
CVE-2013-2049 | High | 7.5 | 2018-05-01 | Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret. |
CVE-2018-0564 | High | 8.1 | 2018-04-20 | Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0… |
CVE-2018-0229 | Medium | 6.5 | 2018-04-19 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mobility Cli… |
CVE-2018-6959 | Critical | 9.8 | 2018-04-13 | VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking o… |
CVE-2017-18125 | High | 7.5 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD… |
CVE-2018-2409 | Medium | 6.3 | 2018-04-10 | Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of some other user may… |
CVE-2018-2408 | High | 7.3 | 2018-04-10 | Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a… |
CVE-2018-5465 | High | 8.8 | 2018-03-06 | A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fi… |
CVE-2017-1270 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. Th… |
CVE-2017-11562 | High | 8.8 | 2017-12-19 | A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login_if.php. |
CVE-2017-10890 | Medium | 4.6 | 2017-11-17 | Session management issue in RX-V200 firmware versions prior to 09.87.17.09, RX-V100 firmware versions prior to 03.29.17.09, RX-CLV1-P firmware versions prior t… |
CVE-2017-1000150 | High | 8.8 | 2017-11-03 | Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the s… |
CVE-2017-14163 | High | 8.8 | 2017-10-31 | An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without lo… |
CVE-2017-15304 | Critical | 9.8 | 2017-10-15 | /bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" hea… |
CVE-2017-11191 | High | 8.8 | 2017-09-28 | FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session… |
CVE-2017-14263 | High | 8.1 | 2017-09-11 | Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and th… |
CVE-2017-12225 | Medium | 6.5 | 2017-09-07 | A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's admi… |
CVE-2016-10405 | Critical | 9.8 | 2017-09-07 | Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecif… |
CVE-2017-12873 | Critical | 9.8 | 2017-09-01 | SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by lever… |
CVE-2017-12868 | Critical | 9.8 | 2017-09-01 | The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct se… |
CVE-2017-12965 | Critical | 9.8 | 2017-08-23 | Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter. |
CVE-2015-1820 | Critical | 9.8 | 2017-08-09 | REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by lever… |
CVE-2015-1174 | Critical | 9.8 | 2017-08-02 | Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a se… |
CVE-2016-9981 | High | 8.1 | 2017-08-02 | IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257 |
CVE-2016-8638 | Critical | 9.1 | 2017-07-12 | A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions… |
CVE-2017-10600 | Medium | 5.9 | 2017-07-11 | ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image… |
CVE-2017-2145 | Medium | 5.4 | 2017-07-07 | Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors. |
CVE-2017-4963 | High | 8.1 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.1… |
CVE-2017-4014 | High | 8.0 | 2017-05-17 | Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view, add, and remove… |