CWE-384 · Session Fixation (page 5)
Page 5 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18125 | High | 7.5 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD… |
CVE-2018-2409 | Medium | 6.3 | 2018-04-10 | Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of some other user may… |
CVE-2018-2408 | High | 7.3 | 2018-04-10 | Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a… |
CVE-2018-5465 | High | 8.8 | 2018-03-06 | A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fi… |
CVE-2017-1270 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. Th… |
CVE-2017-11562 | High | 8.8 | 2017-12-19 | A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login_if.php. |
CVE-2017-10890 | Medium | 4.6 | 2017-11-17 | Session management issue in RX-V200 firmware versions prior to 09.87.17.09, RX-V100 firmware versions prior to 03.29.17.09, RX-CLV1-P firmware versions prior t… |
CVE-2017-1000150 | High | 8.8 | 2017-11-03 | Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the s… |
CVE-2017-14163 | High | 8.8 | 2017-10-31 | An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without lo… |
CVE-2017-15304 | Critical | 9.8 | 2017-10-15 | /bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" hea… |
CVE-2017-11191 | High | 8.8 | 2017-09-28 | FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session… |
CVE-2017-14263 | High | 8.1 | 2017-09-11 | Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and th… |
CVE-2017-12225 | Medium | 6.5 | 2017-09-07 | A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's admi… |
CVE-2016-10405 | Critical | 9.8 | 2017-09-07 | Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecif… |
CVE-2017-12873 | Critical | 9.8 | 2017-09-01 | SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by lever… |
CVE-2017-12868 | Critical | 9.8 | 2017-09-01 | The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct se… |
CVE-2017-12965 | Critical | 9.8 | 2017-08-23 | Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter. |
CVE-2015-1820 | Critical | 9.8 | 2017-08-09 | REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by lever… |
CVE-2015-1174 | Critical | 9.8 | 2017-08-02 | Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a se… |
CVE-2016-9981 | High | 8.1 | 2017-08-02 | IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257 |
CVE-2016-8638 | Critical | 9.1 | 2017-07-12 | A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions… |
CVE-2017-10600 | Medium | 5.9 | 2017-07-11 | ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image… |
CVE-2017-2145 | Medium | 5.4 | 2017-07-07 | Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors. |
CVE-2017-4963 | High | 8.1 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.1… |
CVE-2017-4014 | High | 8.0 | 2017-05-17 | Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view, add, and remove… |
CVE-2017-0892 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to… |
CVE-2016-0721 | High | 8.1 | 2017-04-21 | Session fixation vulnerability in pcsd in pcs before 0.9.157. |
CVE-2017-5656 | High | 7.5 | 2017-04-18 | Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker co… |
CVE-2017-1152 | Medium | 4.3 | 2017-04-14 | IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in furthe… |
CVE-2017-6412 | High | 8.1 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310. |
CVE-2016-9125 | Critical | 9.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating t… |
CVE-2017-5831 | Medium | 5.9 | 2017-03-03 | Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack… |
CVE-2016-10205 | High | 7.3 | 2017-03-03 | Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. |
CVE-2017-5141 | Medium | 6.0 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can esta… |
CVE-2016-9703 | Low | 2.4 | 2017-02-01 | IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work stat… |
CVE-2016-6043 | High | 7.0 | 2017-02-01 | Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2016-6040 | Medium | 5.0 | 2017-02-01 | IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2015-4594 | Critical | 9.8 | 2017-01-10 | eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new sessio… |
CVE-2014-4789 | | 2014-09-10 | Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1… | |
CVE-2008-3222 | | 2008-07-18 | Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allo… | |
CVE-2007-4188 | | 2007-08-08 | Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unspecified vectors. | |
CVE-2001-1534 | | 2001-12-31 | mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID… | |
CVE-1999-0428 | | 1999-03-22 | OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. |