CWE-488: Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- cocoapods, cocoapods trunk.cocoapods.org +1 moreCoacoaPods trunk sessions verification step could be manipulated for owner session hijacking8.2 High
- red hat eap 8.0.1, build of apache camel - hawtio 4, build of apache camel 4.4.1 for spring boot 3.2 +11 more +13 moreUndertow: url-encoded request path information can be broken on ajp-listener7.5 High
typo3/cms-corePackagistTYPO3 Security Misconfiguration in Frontend Session Handling8.2 High- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 moreGnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate7.5 High
- papercut mf, ng, ng, papercut mf +2 moreImproper authorization controls in PaperCut NG/MF4.8 Medium
- denoDeno's Node.js Compatibility Runtime has Cross-Session Data Contamination7.2 High
- bentley assetwise alim web, assetwise information integrity server +1 moreIn the Bentley ALIM Web application, certain configuration settings can cause exposure of a user...9.1 Critical
- mia technology mia-medSeeing admin password hash value in Mia Technology's Mia-Med7.5 High
- intel data center managerExposure of data element to wrong session in the Intel DCM software before version 5.0.1 may...6.8 Medium
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +9 more +11 moreKeycloak: session takeover with oidc offline refreshtokens6.8 Medium