Total
287 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-42322 | 1 Icmsdev | 1 Icms | 2024-02-28 | N/A | 9.8 CRITICAL |
| Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information. | |||||
| CVE-2023-45687 | 1 Southrivertech | 2 Titan Mft Server, Titan Sftp Server | 2024-02-28 | N/A | 8.8 HIGH |
| A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing | |||||
| CVE-2023-30056 | 1 Fico | 1 Origination Manager Decision | 2024-02-28 | N/A | 7.5 HIGH |
| A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie. | |||||
| CVE-2023-32997 | 1 Jenkins | 1 Cas | 2024-02-28 | N/A | 8.8 HIGH |
| Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. | |||||
| CVE-2023-28316 | 1 Rocket.chat | 1 Rocket.chat | 2024-02-28 | N/A | 9.8 CRITICAL |
| A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled. | |||||
| CVE-2023-2105 | 1 Easyappointments | 1 Easyappointments | 2024-02-28 | N/A | 8.8 HIGH |
| Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | |||||
| CVE-2023-28809 | 1 Hikvision | 52 Ds-k1t320efwx, Ds-k1t320efwx Firmware, Ds-k1t320efx and 49 more | 2024-02-28 | N/A | 7.5 HIGH |
| Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user. | |||||
| CVE-2023-31498 | 1 Phpgurukul | 1 Hospital Management System | 2024-02-28 | N/A | 9.8 CRITICAL |
| A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter. | |||||
| CVE-2023-29019 | 1 Fastify | 1 Passport | 2024-02-28 | N/A | 8.1 HIGH |
| @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2022-31888 | 1 Enhancesoft | 1 Osticket | 2024-02-28 | N/A | 8.8 HIGH |
| Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. | |||||
| CVE-2023-3394 | 1 Fossbilling | 1 Fossbilling | 2024-02-28 | N/A | 5.4 MEDIUM |
| Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. | |||||
| CVE-2023-3192 | 1 Froxlor | 1 Froxlor | 2024-02-28 | N/A | 5.4 MEDIUM |
| Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. | |||||
| CVE-2023-1265 | 1 Gitlab | 1 Gitlab | 2024-02-28 | N/A | 4.5 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance. | |||||
| CVE-2021-29368 | 1 Cuppacms | 1 Cuppacms | 2024-02-28 | N/A | 8.8 HIGH |
| Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions. | |||||
| CVE-2020-15679 | 1 Mozilla | 1 Vpn | 2024-02-28 | N/A | 7.6 HIGH |
| An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions. This vulnerability affects Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2, and Mozilla VPN Android 1.1.0 < (1360). | |||||
| CVE-2023-24427 | 1 Jenkins | 1 Bitbucket Oauth | 2024-02-28 | N/A | 9.8 CRITICAL |
| Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. | |||||
| CVE-2022-44017 | 1 Simmeth | 1 Lieferantenmanager | 2024-02-28 | N/A | 7.5 HIGH |
| An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after the victim logged out - /LMS/LM/#main can be used for this. This is due to the credentials not being cleaned from the local storage after logout. | |||||
| CVE-2022-4231 | 1 Tribalsystems | 1 Zenario | 2024-02-28 | N/A | 5.4 MEDIUM |
| A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214589 was assigned to this vulnerability. | |||||
| CVE-2021-42761 | 1 Fortinet | 1 Fortiweb | 2024-02-28 | N/A | 9.8 CRITICAL |
| A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session. | |||||
| CVE-2022-24895 | 1 Sensiolabs | 1 Symfony | 2024-02-28 | N/A | 8.8 HIGH |
| Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch. | |||||