CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- maggioli appalti \& contrattiAn issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user...6.5 Medium
- backclickAn issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of...8.8 High
- zoneminderSession fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie...4.6 Medium
- concretecms concrete cmsConcrete CMS vulnerable to Session Fixation5.4 Medium
- vmware workspace one assistVMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious...9.8 Critical
- siemens power meter sicam q100, 7kg9501-0aa01-2aa1 firmware, 7kg9501-0aa31-2aa1 firmware +2 moreA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER...7.5 High
- php point of sale point of sale, phppointofsale php point of sale +1 moreSession fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.9.8 Critical
- lanner inc iac-ast2500a, lannerinc iac-ast2500a firmware +1 moreSession Fixation and Insufficient Session Expiration5.8 Medium
- enonic xpEnonic XP Session Fixation Vulnerability9.8 Critical
- siemens sicam p850, sicam p855, sicam t +36 more +38 moreA vulnerability has been identified in SICAM P850 (All versions < V3.10), SICAM P850 (All...7.5 High
- ibm sterling partner engagement managerIBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could...6.3 Medium
- comodo firewall, tacitine en6200-prime quad-100 firmware, en6200-prime quad-35 firmware +2 moreImproper Session Management Vulnerability in Tacitine Firewall6.5 Medium
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreSession Fixation in ikus060/rdiffweb6.4 Medium
- apache iotdbLogin check vulnerability by session Id8.8 High
- apache airflowSession Fixation9.8 Critical
- nortekcontrol emerge e3 firmwareNortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo=...6.1 Medium
- snipe snipe/snipe-it, snipeitapp snipe-it +1 moreSession Fixation in snipe/snipe-it4.6 Medium
- wwbn avideoA privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6...8.8 High
- namelessmc nameless, namelessmc/nameless +1 moreSession Fixation in namelessmc/nameless7.0 High
- dell wyse management suiteDell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A...5.4 Medium
- dw megapix firmwareDigital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log...7.5 High
- qnap systems inc. photo stationSession fixation vulnerability in access control management in Synology Photo Station before 6.8...8.1 High
- laravel passportSession Fixation4.8 Medium
- silverstripeHybridsessions does not expire session id on logout6.5 Medium
- gibbonedu gibbonGibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.8.8 High
- filegator, filegator filegator/filegator +1 moreSession Fixation in filegator/filegator4.3 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after...4.3 Medium
- b. braun melsungen ag data module compactplus, spacecom, battery pack with wi-fi +1 more +3 moreB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus6.5 Medium
- fantec mwid25-ds firmwareFANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download...7.5 High
- geon project geonMalicious users can take over the session of other players7.1 High
- runzero platform, shopware +1 moreGuest session is shared between customers in shopware4.8 Medium
- tp-link tl-wa850re firmwareTP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable...9.8 Critical
- ibm financial transaction managerIBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session...6.3 Medium
- dell appsync, emc appsync +1 moreDELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An...8.3 High
- trendnet tew-827dru firmwareTrendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the...10.0 Critical
- reprisesoftware reprise license managerAn issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can...7.5 High
- pluck-cms pluckSession Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to...7.5 High
- auth0 express-openid-connect, express openid connect +1 moreSession fixation in express-openid-connect4.6 Medium
- sensiolabs symfonyCookie persistence in Symfony6.5 Medium
- barrier project barrierAn issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state...8.2 High
- archibus web central** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web...9.8 Critical
- owncloudSession fixation on password protected public links in the ownCloud Server before 10.8.0 allows...5.4 Medium
- gitlabUnder specialized conditions, GitLab may allow a user with an impersonation token to perform Git...6.6 Medium
- netmodule router softwareCertain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with...9.8 Critical
- citrix gateway, application delivery controller firmware, netscaler gateway +2 moreA session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when...8.1 High
- oracle advanced networking option, agile engineering data management, agile product lifecycle management +108 more +110 moreVulnerability in the Advanced Networking Option component of Oracle Database Server. Supported...8.3 High
- jenkinsSession fixation vulnerability in Jenkins7.5 High
- icehrmA session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to...6.1 Medium
- open source joomla, joomla joomla\! +1 moreJoomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to...7.5 High
- nextcloud talk, kiteworks security-advisories +1 moreSession Fixation in Nextcloud Talk6.5 Medium
- Show moreLoading…