Filtered by CWE-384
Filtered by vendor Subscriptions
Total 360 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-13967 2025-06-04 8.8 High
This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. This issue affects EIBPORT V3 KNX: through 3.9.8; EIBPORT V3 KNX GSM: through 3.9.8.
CVE-2023-45718 1 Hcltech 1 Sametime 2025-06-03 3.9 Low
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.  
CVE-2024-23679 1 Enonic 1 Xp 2025-05-30 9.8 Critical
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.
CVE-2023-52353 1 Arm 1 Mbed Tls 2025-05-30 7.5 High
An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum.
CVE-2022-3269 1 Ikus-soft 1 Rdiffweb 2025-05-22 9.8 Critical
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
CVE-2022-40630 1 Tacitine 4 En6200-prime Quad-100, En6200-prime Quad-100 Firmware, En6200-prime Quad-35 and 1 more 2025-05-22 6.5 Medium
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device.
CVE-2024-42171 1 Hcltech 1 Dryice Myxalytics 2025-05-16 6.4 Medium
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session.
CVE-2024-42170 1 Hcltech 1 Dryice Myxalytics 2025-05-16 6.8 Medium
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session.
CVE-2023-47798 1 Liferay 2 Digital Experience Platform, Liferay Portal 2025-05-15 5.4 Medium
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
CVE-2025-46815 2025-05-07 8 High
The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available.
CVE-2021-46279 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2025-05-07 5.8 Medium
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2022-40293 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9.8 Critical
The application was vulnerable to a session fixation that could be used hijack accounts.
CVE-2022-31689 1 Vmware 1 Workspace One Assist 2025-05-01 9.8 Critical
VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
CVE-2025-45949 1 Phpgurukul 1 User Registration \& Login And User Management System 2025-04-30 9.8 Critical
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover.
CVE-2025-45953 1 Phpgurukul 1 Hostel Management System 2025-04-30 9.1 Critical
A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely
CVE-2022-30769 1 Zoneminder 1 Zoneminder 2025-04-30 4.6 Medium
Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.
CVE-2022-43687 1 Concretecms 1 Concrete Cms 2025-04-30 5.4 Medium
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
CVE-2022-44007 1 Backclick 1 Backclick 2025-04-30 8.8 High
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation.
CVE-2022-44788 1 Maggioli 1 Appalti \& Contratti 2025-04-29 6.5 Medium
An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that is issued by the server at the first visit, the cookie value is not updated after a successful login.
CVE-2022-24745 1 Shopware 1 Shopware 2025-04-23 4.8 Medium
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version 6.4.8.2. Users unable to upgrade should disable the HTTP Cache.