CWE-384
424 CVEs • Abstraction: Compound
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVEs (424)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257 |
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sess...Show more |
ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image cr...Show more |
Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors. |
1Pivotal Software 3Cloud Foundry Cf Release Cloud Foundry UaaCloud Foundry Uaa ReleaseMay 13, 2026 Jun 13, 2017 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vuln...Show more |
1Mcafee 1Network Data Loss Prevention May 13, 2026 May 17, 2017 N/A· v4 8.0 HIGH· v3 6.0 MEDIUM· v2 Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request. |
Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file. |
3Clusterlabs FedoraprojectRedhat3Enterprise Linux FedoraPcsMay 13, 2026 Apr 21, 2017 N/A· v4 8.1 HIGH· v3 4.3 MEDIUM· v2 Session fixation vulnerability in pcsd in pcs before 0.9.157. |
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer correspondi...Show more |
1Ibm 1Financial Transaction Manager May 13, 2026 Apr 14, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293. |
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310. |
1Revive Adserver 1Revive Adserver May 13, 2026 Mar 28, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under s...Show more |
1Revive Adserver 1Revive Adserver May 13, 2026 Mar 3, 2017 N/A· v4 5.9 MEDIUM· v3 5.5 MEDIUM· v2 Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID. |
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. |
1Honeywell 1Xl Web Ii Controller May 13, 2026 Feb 13, 2017 N/A· v4 6.0 MEDIUM· v3 6.5 MEDIUM· v2 An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing s...Show more |
1Ibm 1Security Identity Manager Virtual Appliance May 13, 2026 Feb 1, 2017 N/A· v4 2.4 LOW· v3 2.1 LOW· v2 IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information. |
Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced. |
1Ibm 1Rational Collaborative Lifecycle Management May 13, 2026 Feb 1, 2017 N/A· v4 5.0 MEDIUM· v3 6.0 MEDIUM· v2 IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. |
1Eclinicalworks 1Population Health May 6, 2026 Jan 10, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID. |
Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack web sessions via uns...Show more |