CWE-384 · Session Fixation (page 4)
Page 4 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5543 | Critical | 9.8 | 2020-03-16 | TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions… |
CVE-2020-9370 | Critical | 9.1 | 2020-03-05 | HUMAX HGA12R-02 BRGCAA 1.1.53 devices allow Session Hijacking. |
CVE-2020-8990 | Critical | 9.1 | 2020-02-20 | Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. |
CVE-2014-10400 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary… |
CVE-2014-10399 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability… |
CVE-2013-4572 | High | 7.5 | 2020-02-06 | The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies… |
CVE-2013-0507 | High | 8.1 | 2020-02-05 | IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability |
CVE-2019-15612 | Medium | 5.9 | 2020-02-04 | A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. |
CVE-2020-5205 | Medium | 6.5 | 2020-01-09 | In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is use… |
CVE-2019-10158 | Critical | 9.8 | 2020-01-02 | A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration ca… |
CVE-2019-17563 | High | 7.5 | 2019-12-23 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could per… |
CVE-2019-18573 | High | 8.8 | 2019-12-18 | The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authent… |
CVE-2019-8116 | High | 7.5 | 2019-11-05 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated… |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2010-3671 | Medium | 6.5 | 2019-11-05 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijac… |
CVE-2019-17062 | High | 8.8 | 2019-11-05 | An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Editi… |
CVE-2019-18418 | Critical | 9.8 | 2019-10-24 | clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management. |
CVE-2019-15849 | High | 7.3 | 2019-10-17 | eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the s… |
CVE-2019-0062 | High | 7.5 | 2019-10-09 | A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web s… |
CVE-2019-4227 | High | 7.3 | 2019-10-04 | IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixatio… |
CVE-2019-4304 | Medium | 6.3 | 2019-09-30 | IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID… |
CVE-2019-6161 | High | 7.5 | 2019-09-26 | An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware version… |
CVE-2019-12203 | Medium | 6.3 | 2019-09-25 | SilverStripe through 4.3.3 allows session fixation in the "change password" form. |
CVE-2019-13517 | High | 8.8 | 2019-09-06 | In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified whe… |
CVE-2019-12258 | High | 7.5 | 2019-08-09 | Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP o… |
CVE-2019-5406 | High | 7.2 | 2019-08-09 | A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5400 | Medium | 6.3 | 2019-08-09 | A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-10371 | High | 7.5 | 2019-08-07 | A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersona… |
CVE-2019-7849 | High | 7.5 | 2019-08-02 | A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2… |
CVE-2019-4439 | Medium | 5.3 | 2019-07-25 | IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IB… |
CVE-2019-10120 | High | 8.8 | 2019-07-10 | On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to… |
CVE-2019-4152 | Medium | 4.4 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attacker… |
CVE-2019-6584 | High | 8.8 | 2019-06-12 | A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy… |
CVE-2019-10045 | Medium | 6.5 | 2019-05-31 | The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access… |
CVE-2019-1807 | High | 7.6 | 2019-05-03 | A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access… |
CVE-2018-15208 | High | 7.5 | 2019-04-30 | BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter. |
CVE-2019-10008 | High | 8.8 | 2019-04-24 | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an est… |
CVE-2017-12619 | High | 8.1 | 2019-04-23 | Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone". |
CVE-2019-11213 | High | 8.1 | 2019-04-12 | In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthori… |
CVE-2015-5384 | High | 8.8 | 2019-04-03 | AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack. |
CVE-2018-1626 | Low | 3.1 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to sessio… |
CVE-2019-5523 | Critical | 9.8 | 2019-04-01 | VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. S… |
CVE-2017-18105 | High | 8.1 | 2019-03-29 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obt… |
CVE-2019-9744 | High | 8.8 | 2019-03-26 | An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices. There is unauthorized access to… |
CVE-2019-3784 | High | 8.2 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using… |
CVE-2019-3783 | High | 8.8 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brut… |
CVE-2018-1948 | Medium | 4.3 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session co… |
CVE-2019-0102 | High | 8.8 | 2019-02-18 | Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially en… |
CVE-2018-20238 | High | 8.1 | 2019-02-13 | Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expi… |
CVE-2019-7747 | Critical | 9.6 | 2019-02-11 | DbNinja 3.2.7 allows session fixation via the data.php sessid parameter. |
CVE-2019-1003019 | Medium | 5.9 | 2019-02-06 | An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attacker… |
CVE-2018-1962 | Medium | 4.0 | 2019-02-04 | IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session terminat… |
CVE-2019-7350 | High | 7.3 | 2019-02-04 | Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victi… |
CVE-2018-17199 | High | 7.5 | 2019-01-30 | In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to… |
CVE-2018-1000409 | Medium | 5.4 | 2019-01-09 | A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm… |
CVE-2018-1804 | Low | 3.7 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cook… |
CVE-2018-1485 | Low | 3.1 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session… |
CVE-2018-1484 | Low | 3.7 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be a… |
CVE-2018-1480 | Medium | 4.0 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Sit… |
CVE-2018-13337 | Medium | 5.4 | 2018-11-27 | Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript. |
CVE-2018-19443 | Medium | 5.9 | 2018-11-22 | The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc… |
CVE-2018-6434 | High | 7.5 | 2018-11-08 | A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipu… |
CVE-2018-18926 | Critical | 9.8 | 2018-11-04 | Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/ses… |
CVE-2018-18925 | Critical | 9.8 | 2018-11-04 | Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session… |
CVE-2018-13282 | Medium | 5.6 | 2018-10-31 | Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHP… |
CVE-2018-16463 | Low | 3.1 | 2018-10-30 | A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protecte… |
CVE-2018-18380 | Medium | 5.4 | 2018-10-19 | A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a us… |
CVE-2018-17902 | Medium | 5.3 | 2018-10-12 | Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The application utilizes multiple methods of session management whic… |
CVE-2018-9082 | High | 8.8 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does no… |
CVE-2018-8852 | High | 8.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives… |
CVE-2018-1127 | Medium | 4.2 | 2018-09-11 | Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few min… |
CVE-2017-1368 | Medium | 4.3 | 2018-08-06 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers… |
CVE-2016-8609 | Low | 3.7 | 2018-08-01 | It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from… |
CVE-2018-5385 | High | 8.8 | 2018-07-24 | Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authent… |
CVE-2016-9574 | Medium | 5.9 | 2018-07-19 | nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA. |
CVE-2018-14387 | High | 8.8 | 2018-07-18 | An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The… |
CVE-2016-6545 | Critical | 9.8 | 2018-07-13 | Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded… |
CVE-2018-1492 | Medium | 4.3 | 2018-07-10 | IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out fr… |
CVE-2018-1000602 | Medium | 5.9 | 2018-06-26 | A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate an… |
CVE-2018-1000519 | Medium | 6.5 | 2018-06-26 | aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/… |
CVE-2018-12538 | High | 8.8 | 2018-06-22 | In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is… |
CVE-2018-0359 | Medium | 5.5 | 2018-06-21 | A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenti… |
CVE-2018-9026 | High | 7.5 | 2018-06-18 | A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request. |
CVE-2018-12071 | Critical | 9.8 | 2018-06-17 | A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled. |
CVE-2017-3968 | High | 7.5 | 2018-06-13 | Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) b… |
CVE-2018-11385 | High | 8.1 | 2018-06-13 | An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x befo… |
CVE-2018-11714 | Critical | 9.8 | 2018-06-04 | An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622… |
CVE-2018-11571 | High | 8.8 | 2018-05-31 | ClipperCMS 1.3.3 allows Session Fixation. |
CVE-2018-11567 | Low | 3.3 | 2018-05-30 | Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa do… |
CVE-2018-1375 | Medium | 5.9 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could lead to session fixati… |
CVE-2018-11475 | High | 8.0 | 2018-05-25 | Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different… |
CVE-2018-11474 | High | 8.0 | 2018-05-25 | Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_id=1 does not inval… |
CVE-2018-1148 | Medium | 6.5 | 2018-05-18 | In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system… |
CVE-2018-10591 | Medium | 6.1 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10252 | High | 8.1 | 2018-05-14 | An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking… |
CVE-2018-1000173 | Medium | 5.9 | 2018-05-08 | A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to i… |
CVE-2013-2049 | High | 7.5 | 2018-05-01 | Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret. |
CVE-2018-0564 | High | 8.1 | 2018-04-20 | Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0… |
CVE-2018-0229 | Medium | 6.5 | 2018-04-19 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mobility Cli… |
CVE-2018-6959 | Critical | 9.8 | 2018-04-13 | VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking o… |