Overview 87 matches · 11 in Waratek scope · 0 protected · 2 exploited · 1 CISA KEV · 7 public PoC · 1 EPSS ≥ 0.5
87matches
11in Waratek scope12.6%
0protected0.0%
2exploited2.3%
1CISA KEV1.1%
7public PoC8.0%
1EPSS ≥ 0.51.1%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
11
12.6%
Outside Waratek scope
0
0.0%
Not applicable
76
87.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
87
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 17 / year
201710
Not applicable10
Critical10
not blocked10
Working exploit published2
No public exploit8
20187
Not applicable7
Critical7
not blocked7
Exploited1
Working exploit published1
No public exploit5
20193
Not applicable3
Critical3
not blocked3
Working exploit published1
No public exploit2
20207
No exploit published1
Not applicable6
Critical7
not blocked7
No public exploit7
20213
Not applicable3
Critical3
not blocked3
No public exploit3
20227
No exploit published1
Not applicable6
Critical7
not blocked7
Proof of concept only1
No public exploit6
202312
No exploit published3
Not applicable9
Critical12
not blocked12
Proof of concept only3
No public exploit9
20247
No exploit published2
Not applicable5
Critical7
not blocked7
No public exploit7
202514
Not applicable14
Critical14
not blocked14
Working exploit published1
Proof of concept only7
No public exploit6
202617
No exploit published4
Not applicable13
Critical17
not blocked17
Exploited1
Proof of concept only3
No public exploit13
2017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-119446 | Critical | 2026-11-10 | Not applicable | Proof of concept only | Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login. The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves. This issue affects nerves_hub: from 2.5.0 before 2.5.3. |
| CVE-2026-93909 | Critical | 2026-10-13 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. |
| CVE-2024-34324 | Critical | 2026-10-13 | Not applicable | No public exploit | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie. |
| CVE-2026-92414 | Critical | 2026-10-07 | No exploit published | No public exploit | : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue. |
| CVE-2026-102489 | Critical | 2026-09-30 | Not applicable | Exploited | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework. |
| CVE-2026-92609 | Critical | 2026-09-25 | No exploit published | No public exploit | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue. |
| CVE-2026-75171 | Critical | 2026-09-04 | Not applicable | No public exploit | An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. |
| CVE-2026-18527 | Critical | 2026-08-28 | Not applicable | No public exploit | IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system. |
| CVE-2026-81826 | Critical | 2026-08-27 | Not applicable | No public exploit | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that attacker’s access. The session remains usable until it expires naturally. The upstream commit describes this directly as: “session keeps working until it expires.” The fix detects password changes and explicitly invokes _invalidate_user_sessions(user.id) after the database update. This is applied in both edit_user_core() and admin_edit_user_core(). Version impacted >=3.3.0 |
| CVE-2021-32088 | Critical | 2026-07-27 | Not applicable | No public exploit | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie. |
| CVE-2026-56425 | Critical | 2026-06-22 | Not applicable | No public exploit | The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session identifier (session_id()) as the OAuth state parameter. Because session identifiers are long-lived authentication credentials, exposing them in OAuth redirect URLs could leak valid session tokens through browser history, HTTP Referer headers, reverse proxies, access logs, or third-party infrastructure involved in the authentication flow. If obtained by an attacker, the leaked session identifier could potentially be used for session hijacking. Additionally, the implementation did not regenerate the session identifier after successful authentication, leaving authenticated sessions susceptible to session fixation attacks where an attacker forces a victim to use a known session identifier before login and later reuses that identifier after authentication. The OAuth state value was also not implemented as a dedicated, single-use nonce. This weakened CSRF protections and increased the risk of replay attacks against the OAuth callback process. The authentication flow further failed to enforce HTTPS for the configured OAuth redirect URI. If a non-HTTPS redirect URI was used, OAuth authorization codes and access tokens could traverse the network in plaintext, exposing sensitive credentials to network attackers. Finally, OAuth error responses containing attacker-controlled GET parameters were logged verbatim. An attacker could inject control characters or crafted log content, leading to log forging, log injection, or corruption of audit records. The fix introduces: * A dedicated cryptographically random OAuth state value. * Single-use state validation and invalidation. * Constant-time state comparison using hash_equals(). * Session identifier rotation after successful authentication. * Enforcement of HTTPS-only redirect URIs. * Sanitized and length-limited logging of OAuth error parameters. AAD Authentication Plugin (OAuth 2.0 / Azure Active Directory integration) |
| CVE-2009-10007 | Critical | 2026-06-09 | Not applicable | No public exploit | Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim. |
| CVE-2025-67446 | Critical | 2026-06-04 | Not applicable | Proof of concept only | Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for authentication. By modifying the cookie value (e.g., setting it to "admin"), an attacker can bypass the authentication schema and gain unauthorized access to admin functionalities. |
| CVE-2026-40010 | Critical | 2026-05-06 | No exploit published | No public exploit | Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue. |
| CVE-2026-33757 | Critical | 2026-03-27 | Not applicable | No public exploit | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the `direct` mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for `direct` type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with `callback_mode=direct` or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao. |
| CVE-2025-7015 | Critical | 2026-01-29 | Not applicable | No public exploit | Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12. |
| CVE-2025-69602 | Critical | 2026-01-28 | Not applicable | Proof of concept only | A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session. |
| CVE-2025-63224 | Critical | 2025-11-19 | Not applicable | Proof of concept only | The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices. |
| CVE-2025-63216 | Critical | 2025-11-18 | Not applicable | Proof of concept only | The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices. |
| CVE-2025-59841 | Critical | 2025-09-25 | Not applicable | No public exploit | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1. |
| CVE-2025-52689 | Critical | 2025-07-16 | Not applicable | Proof of concept only | Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the login request, potentially allowing the attacker to modify the behaviour of the access point. |
| CVE-2024-13967 | Critical | 2025-06-04 | Not applicable | No public exploit | This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. This issue affects EIBPORT V3 KNX: through 3.9.8; EIBPORT V3 KNX GSM: through 3.9.8. |
| CVE-2025-45953 | Critical | 2025-04-28 | Not applicable | Proof of concept only | A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely |
| CVE-2025-45949 | Critical | 2025-04-28 | Not applicable | Proof of concept only | A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover. |
| CVE-2025-28242 | Critical | 2025-04-18 | Not applicable | Working exploit published | Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack. |
| CVE-2025-28238 | Critical | 2025-04-18 | Not applicable | Proof of concept only | Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack. |
| CVE-2025-27661 | Critical | 2025-03-05 | Not applicable | No public exploit | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004. |
| CVE-2022-40916 | Critical | 2025-02-06 | Not applicable | Proof of concept only | Tiny File Manager v2.4.7 and below is vulnerable to session fixation. |
| CVE-2025-24503 | Critical | 2025-01-30 | Not applicable | No public exploit | A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. |
| CVE-2024-57052 | Critical | 2025-01-27 | Not applicable | No public exploit | An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file. |
| CVE-2024-13279 | Critical | 2025-01-09 | Not applicable | No public exploit | Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0. |
| CVE-2024-50339 | Critical | 2024-12-12 | Not applicable | No public exploit | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue. |
| CVE-2024-11317 | Critical | 2024-12-05 | Not applicable | No public exploit | Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 |
| CVE-2023-52268 | Critical | 2024-11-12 | Not applicable | No public exploit | The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub. |
| CVE-2024-23590 | Critical | 2024-11-04 | No exploit published | No public exploit | Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue. |
| CVE-2024-8643 | Critical | 2024-09-27 | Not applicable | No public exploit | Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0. |
| CVE-2024-38513 | Critical | 2024-07-01 | Not applicable | No public exploit | Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies. |
| CVE-2024-23679 | Critical | 2024-01-19 | No exploit published | No public exploit | Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes. |
| CVE-2023-48929 | Critical | 2023-12-08 | Not applicable | No public exploit | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resource allows an attacker to escalate privileges and obtain sensitive information. |
| CVE-2023-5309 | Critical | 2023-11-07 | Not applicable | No public exploit | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. |
| CVE-2023-0897 | Critical | 2023-10-26 | Not applicable | No public exploit | Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests. |
| CVE-2023-42322 | Critical | 2023-09-20 | Not applicable | No public exploit | Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information. |
| CVE-2023-41012 | Critical | 2023-09-05 | Not applicable | Proof of concept only | An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authentication mechanism. |
| CVE-2023-31498 | Critical | 2023-05-11 | Not applicable | Proof of concept only | A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter. |
| CVE-2023-28316 | Critical | 2023-05-09 | Not applicable | No public exploit | A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled. |
| CVE-2021-36394 | Critical | 2023-03-06 | Not applicable | Proof of concept only | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
| CVE-2021-42761 | Critical | 2023-02-16 | Not applicable | No public exploit | A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session. |
| CVE-2023-24456 | Critical | 2023-01-26 | No exploit published | No public exploit | Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. |
| CVE-2023-24444 | Critical | 2023-01-26 | No exploit published | No public exploit | Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. |
| CVE-2023-24427 | Critical | 2023-01-26 | No exploit published | No public exploit | Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. |
| CVE-2022-36437 | Critical | 2022-12-29 | No exploit published | No public exploit | The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3. |
| CVE-2022-31689 | Critical | 2022-11-09 | Not applicable | No public exploit | VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token. |
| CVE-2022-40293 | Critical | 2022-10-31 | Not applicable | No public exploit | The application was vulnerable to a session fixation that could be used hijack accounts. |
| CVE-2022-40630 | Critical | 2022-09-23 | Not applicable | No public exploit | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device. |
| CVE-2022-3269 | Critical | 2022-09-23 | Not applicable | Proof of concept only | Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. |
| CVE-2022-38054 | Critical | 2022-09-02 | Not applicable | No public exploit | In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation. |
| CVE-2021-38869 | Critical | 2022-04-27 | Not applicable | No public exploit | IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. IBM X-Force ID: 208341. |
| CVE-2021-20151 | Critical | 2021-12-30 | Not applicable | No public exploit | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker (whether from a different computer, different web browser on the same machine, etc.) to take over an existing session. This does require the attacker to be able to spoof or take over original IP address of the original user's session. |
| CVE-2021-41553 | Critical | 2021-10-05 | Not applicable | No public exploit | In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020 |
| CVE-2021-39290 | Critical | 2021-08-23 | Not applicable | No public exploit | Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800. |
| CVE-2020-8434 | Critical | 2020-05-19 | Not applicable | No public exploit | Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode it to a client-side cookie for persistent session authentication. By knowing the key and algorithm, an attacker can select any username, encrypt it, base64 encode it, and save it in their browser with the correct JICSLoginCookie cookie format to impersonate any real user in the JICS database without the need for authenticating (or verifying with MFA if implemented). |
| CVE-2020-12258 | Critical | 2020-05-18 | Not applicable | No public exploit | rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259. |
| CVE-2020-11729 | Critical | 2020-04-15 | Not applicable | No public exploit | An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful. |
| CVE-2020-5543 | Critical | 2020-03-16 | Not applicable | No public exploit | TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allows remote attackers to stop the network functions or execute malware via a specially crafted packet. |
| CVE-2020-9370 | Critical | 2020-03-05 | Not applicable | No public exploit | HUMAX HGA12R-02 BRGCAA 1.1.53 devices allow Session Hijacking. |
| CVE-2020-8990 | Critical | 2020-02-20 | Not applicable | No public exploit | Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. |
| CVE-2019-10158 | Critical | 2020-01-02 | No exploit published | No public exploit | A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling. |
| CVE-2019-18418 | Critical | 2019-10-24 | Not applicable | Working exploit published | clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management. |
| CVE-2019-5523 | Critical | 2019-04-01 | Not applicable | No public exploit | VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session. |
| CVE-2019-7747 | Critical | 2019-02-11 | Not applicable | No public exploit | DbNinja 3.2.7 allows session fixation via the data.php sessid parameter. |
| CVE-2018-18926 | Critical | 2018-11-04 | Not applicable | No public exploit | Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron. |
| CVE-2018-18925 | Critical | 2018-11-04 | Not applicable | Working exploit published | Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. |
| CVE-2016-6545 | Critical | 2018-07-13 | Not applicable | No public exploit | Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password. |
| CVE-2018-12071 | Critical | 2018-06-17 | Not applicable | No public exploit | A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled. |
| CVE-2017-3968 | Critical | 2018-06-13 | Not applicable | No public exploit | Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie. |
| CVE-2018-11714 | Critical | 2018-06-04 | Not applicable | Exploited | An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action. |
| CVE-2018-6959 | Critical | 2018-04-13 | Not applicable | No public exploit | VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session. |
| CVE-2017-15304 | Critical | 2017-10-15 | Not applicable | No public exploit | /bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" header. This can be used to achieve persistent access to the admin panel even after an admin password change. |
| CVE-2016-10405 | Critical | 2017-09-07 | Not applicable | No public exploit | Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors. |
| CVE-2017-12873 | Critical | 2017-09-01 | Not applicable | No public exploit | SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured. |
| CVE-2017-12868 | Critical | 2017-09-01 | Not applicable | No public exploit | The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation. |
| CVE-2017-12965 | Critical | 2017-08-23 | Not applicable | Working exploit published | Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter. |
| CVE-2015-1820 | Critical | 2017-08-09 | Not applicable | No public exploit | REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect. |
| CVE-2015-1174 | Critical | 2017-08-02 | Not applicable | No public exploit | Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id. |
| CVE-2016-8638 | Critical | 2017-07-12 | Not applicable | No public exploit | A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability." |
| CVE-2016-9125 | Critical | 2017-03-28 | Not applicable | No public exploit | Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session. |
| CVE-2015-4594 | Critical | 2017-01-10 | Not applicable | Working exploit published | eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID. |