Search
Total
67 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-12203 | 1 Silverstripe | 1 Silverstripe | 2019-09-27 | 3.7 LOW | 6.3 MEDIUM |
| SilverStripe through 4.3.3 allows session fixation in the "change password" form. | |||||
| CVE-2019-5400 | 1 Hp | 2 3par Service Processor, 3par Service Processor Firmware | 2019-08-16 | 6.5 MEDIUM | 6.3 MEDIUM |
| A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. | |||||
| CVE-2019-10045 | 1 Pydio | 1 Pydio | 2019-06-03 | 6.4 MEDIUM | 6.5 MEDIUM |
| The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her (if the session is still active). | |||||
| CVE-2018-1000409 | 1 Jenkins | 1 Jenkins | 2019-05-08 | 5.8 MEDIUM | 5.4 MEDIUM |
| A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a user signed up for a new user account. | |||||
| CVE-2018-18380 | 1 Bigtreecms | 1 Bigtree Cms | 2019-01-25 | 5.8 MEDIUM | 5.4 MEDIUM |
| A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session. | |||||
| CVE-2018-13337 | 1 Terra-master | 1 Terramaster Operating System | 2018-12-21 | 5.8 MEDIUM | 5.4 MEDIUM |
| Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript. | |||||
| CVE-2018-19443 | 1 Tryton | 1 Tryton | 2018-12-20 | 4.3 MEDIUM | 5.9 MEDIUM |
| The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle. | |||||
| CVE-2018-1000519 | 1 Aio-libs Project | 1 Aiohttp | 2018-08-30 | 4.3 MEDIUM | 6.5 MEDIUM |
| aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie). | |||||
| CVE-2018-1000602 | 1 Jenkins | 1 Saml | 2018-08-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session. | |||||
| CVE-2018-1148 | 1 Tenable | 1 Nessus | 2018-06-20 | 4.0 MEDIUM | 6.5 MEDIUM |
| In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change. | |||||
| CVE-2018-1000173 | 1 Jenkins | 1 Google Login | 2018-06-13 | 4.3 MEDIUM | 5.9 MEDIUM |
| A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. | |||||
| CVE-2017-10890 | 1 Sharp | 10 Rx-clv1-p, Rx-clv1-p Firmware, Rx-clv2-b and 7 more | 2017-12-08 | 4.3 MEDIUM | 4.6 MEDIUM |
| Session management issue in RX-V200 firmware versions prior to 09.87.17.09, RX-V100 firmware versions prior to 03.29.17.09, RX-CLV1-P firmware versions prior to 79.17.17.09, RX-CLV2-B firmware versions prior to 89.07.17.09, RX-CLV3-N firmware versions prior to 91.09.17.10 allows an attacker on the same LAN to perform arbitrary operations or access information via unspecified vectors. | |||||
| CVE-2017-2145 | 1 Cybozu | 1 Garoon | 2017-07-14 | 5.8 MEDIUM | 5.4 MEDIUM |
| Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors. | |||||
| CVE-2017-1152 | 1 Ibm | 1 Financial Transaction Manager | 2017-06-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293. | |||||
| CVE-2017-5831 | 1 Revive-adserver | 1 Revive Adserver | 2017-03-07 | 5.5 MEDIUM | 5.9 MEDIUM |
| Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID. | |||||
| CVE-2017-5141 | 1 Honeywell | 1 Xl Web Ii Controller | 2017-02-17 | 6.5 MEDIUM | 6.0 MEDIUM |
| An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated sessions (SESSION FIXATION). | |||||
| CVE-2016-6040 | 1 Ibm | 1 Rational Collaborative Lifecycle Management | 2017-02-08 | 6.0 MEDIUM | 5.0 MEDIUM |
| IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. | |||||