CWE-384
412 CVEs • Abstraction: Compound
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVEs (412)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Revive Adserver 1Revive Adserver May 13, 2026 Mar 3, 2017 N/A· v4 5.9 MEDIUM· v3 5.5 MEDIUM· v2 Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID. |
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. |
1Honeywell 1Xl Web Ii Controller May 13, 2026 Feb 13, 2017 N/A· v4 6.0 MEDIUM· v3 6.5 MEDIUM· v2 An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing s...Show more |
1Ibm 1Security Identity Manager Virtual Appliance May 13, 2026 Feb 1, 2017 N/A· v4 2.4 LOW· v3 2.1 LOW· v2 IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information. |
Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced. |
1Ibm 1Rational Collaborative Lifecycle Management May 13, 2026 Feb 1, 2017 N/A· v4 5.0 MEDIUM· v3 6.0 MEDIUM· v2 IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. |
1Eclinicalworks 1Population Health May 6, 2026 Jan 10, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID. |
Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack web sessions via uns...Show more |
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vector...Show more |
Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unspecified vectors. |
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass...Show more |
OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. |