CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- u-tec ultraloq ul3 bt firmwareIncorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3...8.1 High
- sensiolabs symfonySymfony possible session fixation vulnerability6.5 Medium
- perforce puppet enterprise, puppet enterprise +1 moreBroken Session Management in Puppet Enterprise6.8 Medium
- sielco polyeco1000, polyeco1000 firmware, polyeco300 firmware +1 more +3 moreSession FIxation in Sielco PolyEco10008.8 High
- south river technologies titan mft, titan sftp, southrivertech titan sftp server +1 more +3 moreAuthentication bypass via session fixation in Titan MFT and Titan SFTP servers8.8 High
- uptime.kuma uptime kuma, louislam uptime-kuma +1 moreUptime Kuma has Persistentent User Sessions6.7 Medium
- icmsdev icmsInsecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain...9.8 Critical
- honeywell pc23/43, pd43, pd45, px240, pm23/43 +7 more +9 morePotential Predictable Session ID6.4 Medium
- china mobile communications mobile intelligent home gateway, chinamobile intelligent home gateway firmware +1 moreAn issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a...9.8 Critical
- instantsoft instantsoft/icms2, instantcms +1 moreSession Fixation in instantsoft/icms24.3 Medium
- apache airflowSession fixation in Apache Airflow web interface8.0 High
- hashgraph guardian, nozomi networks cmc +1 moreSession Fixation in Guardian/CMC before 22.6.25.4 Medium
- jenkins openshift login, jenkins project openshift login plugin +1 moreJenkins OpenShift Login Plugin session fixation vulnerability8.8 High
- google androidIn visitUris of Notification.java, there is a possible way to leak image data across user...5.5 Medium
- google androidIn visitUris of RemoteViews.java, there is a possible leak of images between users due to a...5.5 Medium
- video management system project management systemAn issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video...8.8 High
- fossbilling, fossbilling fossbilling/fossbilling +1 moreSession Fixation in fossbilling/fossbilling6.8 Medium
- huawei harmonyos, emui +1 moreVulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful...5.3 Medium
- hikvision ds-k1t320efwx firmware, ds-k1t320efx firmware, ds-k1t320ewx firmware +29 more +31 moreSome access control products are vulnerable to a session hijacking attack because the product...7.5 High
- froxlor, froxlor froxlor/froxlor +1 moreSession Fixation in froxlor/froxlor4.2 Medium
- suse rancherRancher's Azure AD permission changes are not reflected on active sessions8.0 High
- jenkins wso2 oauth, jenkins project wso2 oauth plugin +1 moreJenkins WSO2 Oauth Plugin Session Fixation vulnerability5.4 Medium
- jenkins cas, jenkins project cas plugin +1 moreJenkins CAS Plugin Session Fixation vulnerability8.8 High
- phpgurukul hospital management systemA privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows...9.8 Critical
- fico origination manager decisionA session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to...7.5 High
- rocket.chatA security vulnerability has been discovered in the implementation of 2FA on the rocket.chat...9.8 Critical
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6,...5.4 Medium
- fastify fastify-passport, passport +1 moreCross site request forgery token fixation in fastify-passport6.5 Medium
- fastify fastify-passport, passport +1 moreSession fixation in fastify-passport8.1 High
- alextselegidis alextselegidis/easyappointments, easyappointments +1 moreSession Fixation in alextselegidis/easyappointments5.4 Medium
- oxidforge oxid eshopOXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial...5.4 Medium
- enhancesoft osticketSession Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.8.8 High
- nextauth.js next-authMissing proper state, nonce and PKCE checks for OAuth authentication in next-auth8.1 High
- moodleMoodle Session Fixation vulnerability9.8 Critical
- fortinet fortiwebA condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb...8.5 High
- sensiolabs symfonySymfony vulnerable to Session Fixation of CSRF tokens6.3 Medium
- jenkins keycloak authentication, jenkins project keycloak authentication plugin +1 moreSession fixation vulnerability in Jenkins Keycloak Authentication Plugin9.8 Critical
- jenkins openid, jenkins project openid plugin +1 moreSession fixation vulnerability in Jenkins OpenID Plugin9.8 Critical
- jenkins bitbucket oauth, jenkins project bitbucket oauth plugin +1 moreSession fixation vulnerability in Jenkins Bitbucket OAuth Plugin9.8 Critical
- jenkins openid connect authentication, jenkins project openid connect authentication plugin +1 moreSession fixation vulnerability in Jenkins OpenId Connect Authentication Plugin8.8 High
- cuppacmsSession fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297...8.8 High
- 1panel-dev kubepiKubePi vulnerable to session fixation attack7.5 High
- kassi xingwallkassi xingwall oauth.js session fixiation6.3 Medium
- arubanetworks aruba edgeconnect enterprise orchestrator, hewlett packard enterprise (hpe) aruba edgeconnect enterprise orchestration software +1 moreA vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise...4.6 Medium
- hazelcast, hazelcast hazelcast-jet +1 moreHazelcast connection caching9.1 Critical
- simmeth lieferantenmanagerAn issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session...7.5 High
- mozilla vpn android 1.1.0, vpn ios 1.0.7, vpn windows +1 more +3 moreAn OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could...7.6 High
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +9 more +11 moreKeycloak: session takeover with oidc offline refreshtokens6.8 Medium
- niceforyou linear emerge e3 access control firmwareNortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0...6.1 Medium
- tribal systems zenario cms, tribalsystems zenario +1 moreTribal Systems Zenario CMS Remember Me session fixiation4.2 Medium
- Show moreLoading…