CWE-384

Session Fixation

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

392 vulnerabilities with CWE-384
CVE-2022-31888 HIGH
osTicket <1.16.2 - Info Disclosure
CVSS 8.8
CVE-2022-24895 MEDIUM
Sensiolabs Symfony < 4.4.50 - CSRF
CVSS 6.3
CVE-2022-43529 MEDIUM
Aruba EdgeConnect Enterprise - Privilege Escalation
CVSS 4.6
CVE-2022-36437 CRITICAL
Hazelcast <4.0.7-5.1.3 - SSRF
CVSS 9.1
CVE-2022-44017 HIGH
Simmeth Lieferantenmanager <5.6 - Privilege Escalation
CVSS 7.5
CVE-2022-38628 MEDIUM
Nortek Linear eMerge E3-Series <0.32-09a - XSS
CVSS 6.1
CVE-2022-4231 MEDIUM
Tribal Systems Zenario CMS 9.3.57595 - Session Fixation
CVSS 4.2
CVE-2022-44788 MEDIUM
Appalti & Contratti 9.12.2 - Session Fixation
CVSS 6.5
CVE-2022-44007 HIGH
BACKCLICK Professional <5.9.63 - Privilege Escalation
CVSS 8.8
CVE-2022-30769 MEDIUM
ZoneMinder <1.36.12 - Info Disclosure
CVSS 4.6
CVE-2022-43687 MEDIUM
Concrete CMS <8.5.10, 9.0.0-9.1.2 - Info Disclosure
CVSS 5.4
CVE-2022-31689 CRITICAL
VMware Workspace ONE Assist <22.10 - Privilege Escalation
CVSS 9.8
CVE-2022-43398 HIGH
POWER METER SICAM Q100 < V2.50 - Info Disclosure
CVSS 7.5
CVE-2022-40293 CRITICAL
Phppointofsale PHP Point Of Sale - Session Fixation
CVSS 9.8
CVE-2022-40226 HIGH
SICAM P850 <V3.10 - Info Disclosure
CVSS 7.5
CVE-2022-34334 MEDIUM
IBM Sterling Partner Engagement Manager 2.0 - Privilege Escalation
CVSS 6.5
CVE-2022-40630 MEDIUM
Tacitine Firewall <22.20.1 - Session Fixation
CVSS 6.5
CVE-2022-3269 CRITICAL
ikus060/rdiffweb <2.4.7 - Info Disclosure
CVSS 9.8
CVE-2022-38369 HIGH
Apache IoTDB <0.13.0 - SSRF
CVSS 8.8
CVE-2022-38054 CRITICAL
Apache Airflow <2.3.3 - Info Disclosure
CVSS 9.8
CVE-2022-31798 MEDIUM
Nortekcontrol Emerge E3 Firmware < 0.32-07p - XSS
CVSS 6.1
CVE-2022-2997 HIGH
GitHub snipe/snipe-it <6.0.10 - Info Disclosure
CVSS 8.0
CVE-2022-30605 HIGH
Wwbn Avideo - Privilege Escalation
CVSS 8.8
CVE-2022-2820 HIGH
GitHub repository namelessmc/nameless <v2.0.2 - Info Disclosure
CVSS 7.0
CVE-2022-33927 MEDIUM
Dell Wyse Management Suite <3.6.1 - Session Fixation
CVSS 5.4
Details
Vulnerabilities 392
Links
MITRE CWE Entry Search this CWE With Exploits