CWE-384 · Session Fixation (page 5)
Page 5 of 5 — CVEs classified under CWE-384, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0892 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to… |
CVE-2016-0721 | High | 8.1 | 2017-04-21 | Session fixation vulnerability in pcsd in pcs before 0.9.157. |
CVE-2017-5656 | High | 7.5 | 2017-04-18 | Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker co… |
CVE-2017-1152 | Medium | 4.3 | 2017-04-14 | IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in furthe… |
CVE-2017-6412 | High | 8.1 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310. |
CVE-2016-9125 | Critical | 9.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating t… |
CVE-2017-5831 | Medium | 5.9 | 2017-03-03 | Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack… |
CVE-2016-10205 | High | 7.3 | 2017-03-03 | Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. |
CVE-2017-5141 | Medium | 6.0 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can esta… |
CVE-2016-9703 | Low | 2.4 | 2017-02-01 | IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work stat… |
CVE-2016-6043 | High | 7.0 | 2017-02-01 | Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2016-6040 | Medium | 5.0 | 2017-02-01 | IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2015-4594 | Critical | 9.8 | 2017-01-10 | eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new sessio… |
CVE-2014-4789 | | 2014-09-10 | Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1… | |
CVE-2008-3222 | | 2008-07-18 | Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allo… | |
CVE-2007-4188 | | 2007-08-08 | Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unspecified vectors. | |
CVE-2001-1534 | | 2001-12-31 | mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID… | |
CVE-1999-0428 | | 1999-03-22 | OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. |