CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- gogsGogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as...9.8 Critical
- giteaGitea Remote Code Execution (RCE)9.8 Critical
- qnap systems inc. photo stationSession fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7...5.6 Medium
- hackerone nextcloud server, nextcloud server +1 moreA bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could...3.1 Low
- bigtreecms bigtree cmsA Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user...5.4 Medium
- yokogawa fcj firmware, fcn-100 firmware, fcn-500 firmware +2 more +4 moreYokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The...5.3 Medium
- lenovo group ltd lenovoemc, lenovo ez media \& backup center firmware, ix2 firmware +20 more +22 moreIomega and LenovoEMC NAS Web UI Vulnerabilities8.8 High
- philips e-alert unit (non-medical device), e-alert firmware +1 morePhilips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or...8.8 High
- red hat gluster storageTendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens...4.2 Medium
- ibm security identity governance and intelligenceIBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure...4.3 Medium
- keycloakImproper Authentication in org.keycloak:keycloak-core3.7 Low
- navarino infinityNavarino Infinity web interface up to version 2.2 is prone to session fixation attacks8.8 High
- wondercmsAn issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web...8.8 High
- itrack easy, ieasytec itrackeasy +1 moreiTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request9.8 Critical
- ibm rational collaborative lifecycle management, rational doors next generation, rational engineering lifecycle manager +4 more +6 moreIBM Jazz Foundation products could allow a user with physical access to the system to log in as...4.3 Medium
- jenkins samlJenkins SAML Plugin Session Fixation vulnerability5.9 Medium
- aio-libs aiohttp sessionaiohttp-session Session Fixation vulnerability6.5 Medium
- eclipse jetty, the eclipse foundation eclipse jetty, netapp e-series santricity management plug-ins +10 more +12 moreAccess and integrity issue within Eclipse Jetty8.8 High
- cisco meeting serverA vulnerability in the session identification management functionality of the web-based...5.5 Medium
- broadcom privileged access managerA session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to...7.5 High
- codeigniterCodeIgniter Session Fixation Vulnerability9.8 Critical
- mcafee network data loss prevention (ndlp), network security management (nsm), network data loss prevention +1 more +3 moreMcAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerability7.5 High
- sensiolabs symfony, debian linux, fedoraproject fedora +2 moreSymfony Session Fixation Vulnerability8.1 High
- tp-link tl-wr840n firmware, tl-wr841n firmware +1 moreAn issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel...9.8 Critical
- clippercmsClipperCMS 1.3.3 allows Session Fixation.8.8 High
- amazon echo dot firmware, echo firmware, echo plus firmware +2 more +4 more** DISPUTED ** Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused...3.3 Low
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after...5.9 Medium
- monstraMonstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1...8.0 High
- monstraMonstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at...8.0 High
- tenable nessus, tenable, inc. tenable nessus +1 moreIn Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the...6.5 Medium
- advantech webaccess, webaccess dashboard, webaccess scada +1 more +3 moreIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior,...6.1 Medium
- actiontec wcb6200q firmwareAn issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session...8.1 High
- jenkins google loginJenkins Google Login Plugin Session Fixation vulnerability5.9 Medium
- redhat cloudforms management engineRed Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session...7.5 High
- ec-cube co.,ltd. ec-cubeSession fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3...8.1 High
- cisco anyconnect secure mobility client, adaptive security appliance software +1 moreA vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On...6.5 Medium
- vmware vrealize automationVMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of...9.8 Critical
- qualcomm mdm9206 firmware, mdm9607 firmware, mdm9650 firmware +7 more +9 moreIn Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon...7.5 High
- sap cloud platform, sap se cloud platform connector +1 moreImproper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud...6.3 Medium
- sap se business objects, sap businessobjects +1 moreImproper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI...7.3 High
- belden hirschmann m1-8mm-sc, hirschmann m1-8sfp, hirschmann m1-8sm-sc +131 more +133 moreA Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000,...8.8 High
- ibm security guardiumIBM Security Guardium 10.0 does not renew a session variable after a successful authentication...3.3 Low
- mt4 senhaseguraA Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8...8.8 High
- sharp rx-clv1-p firmware, rx-clv2-b firmware, rx-clv3-n firmware +2 more +4 moreSession management issue in RX-V200 firmware versions prior to 09.87.17.09, RX-V100 firmware...4.6 Medium
- maharaMahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from...8.8 High
- maharaAn issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5,...8.8 High
- airtame hdmi dongle firmware/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an...9.8 Critical
- freeipa** DISPUTED ** FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass...8.8 High
- honeywell enterprise dvr firmware, fusion iv rev c firmware, maxpro nvr hybrid se firmware +4 more +6 moreHoneywell NVR devices allow remote attackers to create a user account in the admin group by...8.1 High
- cisco prime lan management solutionA vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow...6.5 Medium
- Show moreLoading…