Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

CVEs (424)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-43687 1Concretecms 1Concrete Cms Jun 17, 2026 Nov 14, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
CVE-2022-31689 1Vmware 1Workspace One Assist Jun 17, 2026 Nov 9, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
CVE-2022-43398 1Siemens 27kg9501 0aa01 2aa1 Firmware 7kg9501 0aa31 2aa1 Firmware Jun 17, 2026 Nov 8, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V...Show more A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.Show less
CVE-2022-40293 1Phppointofsale 1Php Point Of Sale Jun 17, 2026 Oct 31, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The application was vulnerable to a session fixation that could be used hijack accounts.
CVE-2021-46279 1Lannerinc 1Iac Ast2500a Firmware Jun 17, 2026 Oct 24, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2022-40226 1Siemens 367kg8500 0aa00 0aa0 Firmware 7kg8500 0aa00 2aa0 Firmware7kg8500 0aa10 0aa0 Firmware+33 more Jun 17, 2026 Oct 11, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA0) (All versions < V3.10), SICAM P850 (7...Show more A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA30-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA30-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA01-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA01-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA02-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA02-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA11-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA11-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA12-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA12-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA31-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA31-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA32-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA32-2AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA00-0AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA00-2AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA10-0AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA10-2AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA30-0AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA30-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA01-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA01-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA02-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA02-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA11-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA11-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA12-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA12-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA31-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA31-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA32-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA32-2AA0) (All versions < V3.10), SICAM T (All versions < V3.0). Affected devices accept user defined session cookies and do not renew the session cookie after login/logout. This could allow an attacker to take over another user's session after login.Show less
CVE-2022-34334 1Ibm 1Sterling Partner Engagement Manager Jun 17, 2026 Oct 10, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 229704.
CVE-2022-40630 1Tacitine 2En6200 Prime Quad 100 Firmware En6200 Prime Quad 35 Firmware Jun 17, 2026 Sep 23, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based...Show more This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device.Show less
CVE-2022-3269 1Ikus Soft 1Rdiffweb Jun 17, 2026 Sep 23, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
CVE-2022-38369 1Apache 1Iotdb Jun 17, 2026 Sep 5, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
CVE-2022-38054 1Apache 1Airflow Jun 17, 2026 Sep 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
CVE-2022-31798 1Nortekcontrol 1Emerge E3 Firmware Jun 17, 2026 Aug 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin...Show more Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user account.Show less
CVE-2022-2997 1Snipeitapp 1Snipe It Jun 17, 2026 Aug 25, 2022 N/A· v4 8.0 HIGH· v3 N/A· v2 Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
CVE-2022-30605 1Wwbn 1Avideo Jun 17, 2026 Aug 22, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an au...Show more A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.Show less
CVE-2022-2820 1Namelessmc 1Nameless Jun 17, 2026 Aug 15, 2022 N/A· v4 8.2 HIGH· v3 N/A· v2 Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2.
CVE-2022-33927 1Dell 1Wyse Management Suite Jun 17, 2026 Aug 10, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's...Show more Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session.Show less
CVE-2022-34536 1Dw 1Megapix Firmware Jun 17, 2026 Jul 19, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token.
CVE-2022-22681 1Synology 1Photo Station Jun 17, 2026 Jul 6, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.
CVE-2022-25896 1Passport Project 1Passport Jun 17, 2026 Jul 1, 2022 N/A· v4 4.8 MEDIUM· v3 5.8 MEDIUM· v2 This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
CVE-2022-24444 1Silverstripe 1Silverstripe Jun 17, 2026 Jun 28, 2022 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 Silverstripe silverstripe/framework through 4.10 allows Session Fixation.

Previous 1...101112...22 Next