CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- fortinet fortiosA session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7...4.0 Medium
- freescout helpdesk freescoutThe End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to...9.1 Critical
- f5 nginx openid connect, nginx api connectivity manager, nginx ingress controller +1 more +3 moreNGINX OpenID Connect Vulnerability5.1 Medium
- apache kylinApache Kylin: Session fixation in web interface9.1 Critical
- netadminIn NetAdmin 4.0.30319, an attacker can steal a valid session cookie and inject it into another...8.1 High
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Has Incomplete Server Termination During Explicit Sign-Out4.2 Medium
- phpgurukul boat booking systemPHPGurukul Boat Booking System session_start session fixiation6.9 Medium
- drupal two-factor authentication (tfa), two-factor authentication project authentication +1 moreTwo-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-0439.8 Critical
- oceanic software valeappSession Hijacking in Oceanic Software's ValeApp9.3 Critical
- automationdirect directlogic h2-dm1e, h2-dm1e firmware +1 moreAutomationDirect DirectLogic H2-DM1E Session Fixation8.7 High
- directusDirectus's session is cached for OpenID and OAuth2 if `redirect` is not used7.4 High
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2)....5.3 Medium
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +8 more +10 moreWildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters7.1 High
- ibm aspera sharesIBM Aspera Shares session fixation6.3 Medium
- getoutline outlineAn issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user...8.8 High
- gofiber fiberFiber Session Middleware Token Injection Vulnerability10.0 Critical
- bluditBludit is Vulnerable to Session Fixation5.6 Medium
zendframework/zend-sessionPackagistZend-Session session validation vulnerability6.5 Mediumzendframework/zendframeworkPackagistZendframework session validation vulnerability6.5 Medium- argoproj argo cd, argo-cd +1 moreUnauthenticated Access to sensitive settings in Argo CD5.3 Medium
typo3/cmsPackagistTYPO3 frontend login vulnerable to Session Fixation7.1 Hightypo3/cms-corePackagistTYPO3 Security Misconfiguration in User Session Handling6.5 Medium- interaction design team at the university of applied sciences and arts in hildesheim/germany hawkiSession Fixation7.3 High
- No product listedAn issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R476G routers allows attackers to hijack TCP sessions which c…5.3 Medium
silverstripe/frameworkPackagistsilverstripe/framework's User-Agent header not correctly invalidating user session7.5 Highlaravel/frameworkPackagistLaravel Hijacked authentication cookies vulnerabilityNo scoreilluminate/authPackagistLaravel Hijacked authentication cookies vulnerabilityNo score- open-xchange ox app suiteE-Mails exported as PDF were stored in a cache that did not consider specific session information...5.3 Medium
- ibm storage scaleIBM Storage Scale session fixation5.0 Medium
uptime-kumanpmEnabling Authentication does not close all logged in socket connections immediatelyNo score- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.10 +2 more +4 moreKeycloak: session hijacking via re-authentication6.5 Medium
- zenml, zenml-io zenml-io/zenml +1 moreSession Fixation Vulnerability in zenml-io/zenml4.2 Medium
- dell storage resource manager, storage monitoring and reporting +1 moreDell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in...5.9 Medium
- contaoContao's remember-me tokens will not be cleared after a password change5.9 Medium
- lizardbyte sunshineClients removed during unpairing process may regain access if Sunshine was not restarted5.9 Medium
- bdtask wholesale inventory management system, multi store inventory management system +1 moreBdtask Wholesale Inventory Management System session fixiation4.3 Medium
- zitadelAccount Takeover via Session Fixation in Zitadel [Bypassing MFA]7.5 High
- vmware enhanced authentication plugin, enhanced authentication plug-in (eap) +1 moreSession Hijack Vulnerability in Deprecated EAP Browser Plugin7.8 High
- apache dolphinschedulerApache DolphinScheduler: Session do not expire after password change6.5 Medium
- hcl software sametimeHCL Sametime is impacted by a failure to invalidate sessions3.9 Low
- ibm i access client solutionsIBM i Access Client Solutions information disclosure5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's account lockout does not invalidate existing user sessions5.4 Medium
- graylog, graylog2 graylog2-server +1 moregraylog2-server Session Fixation vulnerability through cookie injection5.7 Medium
- ibm powerscIBM PowerSC session fixation6.3 Medium
- arm mbed tlsAn issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum...7.5 High
- gl.inet a1300, ar300m, ar750 +21 more +23 moreAn issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID...5.5 Medium
- engineers online portal project online portal, sourcecodester engineers online portal +1 moreSourceCodester Engineers Online Portal session fixiation3.1 Low
- imou life app, imoulife imou life +1 moreSession Hijacking on Imou Life app8.1 High
- uptime.kuma uptime kuma, dockge.kuma dockge, louislam uptime-kuma +2 moreUptime Kuma Password Change Vulnerability6.7 Medium
- franklin-electric system sentinel anywareFranklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to...9.8 Critical
- Show moreLoading…