CWE-384

Session Fixation

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

404 vulnerabilities with CWE-384
CVE-2021-46279 MEDIUM
Lanner Inc IAC-AST2500A <1.10.0 - Session Fixation
CVSS 5.8
CVE-2021-38869 CRITICAL
IBM QRadar SIEM <7.5 - Info Disclosure
CVSS 9.8
CVE-2021-39066 HIGH
IBM Financial Transaction Manager 3.2.4 - Info Disclosure
CVSS 8.8
CVE-2021-20151 CRITICAL
Trendnet AC2600 TEW-827DRU <2.08B01 - Session Hijacking
CVSS 10.0
CVE-2021-31745 HIGH
Pluck-CMS Pluck <4.7.15 - Session Fixation
CVSS 7.5
CVE-2021-41246 MEDIUM
Express OpenID Connect <2.5.1 - Session Fixation
CVSS 4.6
CVE-2021-41268 MEDIUM
Symfony/SecurityBundle <5.3.12 - Info Disclosure
CVSS 6.5
CVE-2021-42073 HIGH
Barrier < 2.4.0 - Session Fixation via Client Label Spoofing
CVSS 8.2
CVE-2021-41553 CRITICAL
ARCHIBUS Web Central 21.3.3.815 - Info Disclosure
CVSS 9.8
CVE-2021-35948 MEDIUM
ownCloud Server <10.8.0 - Auth Bypass
CVSS 5.4
CVE-2021-22237 MEDIUM
GitLab <13.12.9, <14.0.7, <14.1.2 - Info Disclosure
CVSS 6.6
CVE-2021-39290 CRITICAL
NetModule <4.3.0.113-4.5.0.105 - Limited Session Fixation
CVSS 9.8
CVE-2021-22927 HIGH
Citrix ADC/Gateway <13.0-82.45 - Session Fixation
CVSS 8.1
CVE-2021-2351 HIGH
Oracle Database Server <19c - Info Disclosure
CVSS 8.3
CVE-2021-32710 MEDIUM
Shopware <6.3.5.2 - Info Disclosure
CVSS 5.9
CVE-2021-35046 MEDIUM
Ice Hrm 29.0.0 - Info Disclosure
CVSS 6.1
CVE-2021-32676 MEDIUM
Nextcloud Talk <9.0.10, 10.0.8, 11.2.2 - Info Disclosure
CVSS 6.5
CVE-2021-33394 MEDIUM
Cubecart 6.4.2 - Session Fixation via Session Cookie Injection
CVSS 5.4
CVE-2020-36913 MEDIUM
All-Dynamics Software enlogic:show 2.0.2 - CSRF
CVSS 5.3
CVE-2020-15679 HIGH
Mozilla VPN <1.2.2 - Session Fixation
CVSS 7.6
CVE-2020-25152 MEDIUM
B. Braun Melsungen AG - Session Fixation
CVSS 6.5
CVE-2020-35229 HIGH
NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 - Privilege Escalation
CVSS 8.8
CVE-2020-35591 MEDIUM
Pi-hole 5.0-5.1.1 - Session Fixation
CVSS 5.4
CVE-2020-4954 MEDIUM
IBM Spectrum Protect Operations Center <8.1 - Auth Bypass
CVSS 5.4
CVE-2020-5021 MEDIUM
IBM Spectrum Protect Plus <10.1.7 - Privilege Escalation
CVSS 4.4
Details
Vulnerabilities 404
Links
MITRE CWE Entry Search this CWE With Exploits