CWE-384 · Authentication
Session Fixation
429CVEs
1exploited
3with a public check
8likely (EPSS 10%+)
SortMost likely exploited
429 CVEs with CWE-384 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-102489In CISA KEVExploitedUndisclosed RCE in Zammad v6.3 and higherZammad GmbH · Zammad · CVSS 8.7 · 2026-09-30 | 8.7 | 50% | 2026-09-30 |
| CVE-2018-18925CheckGogs (Go Git Service) 0.11.66 - Remote Code ExecutionGogs · Gogs · 2018-11-04 | – | 31% | 2018-11-04 |
| CVE-2022-31798CheckNortek Linear eMerge E3-Series - Cross-Site ScriptingNortekcontrol · Emerge E3 Firmware · 2022-08-25 | – | 9.1% | 2022-08-25 |
| CVE-2025-28242CheckDAEnetIP4 METO v1.25 - Session HijackingNo vendor recorded · CVSS 9.8 · 2025-04-18 | 9.8 | 1.9% | 2025-04-18 |
| CVE-2018-11714An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices.…Tp-Link · Tl-Wr840n Firmware · 2018-06-04 | – | 67% | 2018-06-04 |
| CVE-2019-12258Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.Windriver · Vxworks · 2019-08-09 | – | 23% | 2019-08-09 |
| CVE-2018-17199In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_s…Apache Software Foundation · Apache HTTP Server · 2019-01-30 | – | 20% | 2019-01-30 |
| CVE-2019-10008Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrat…Zohocorp · Servicedesk Plus · 2019-04-24 | – | 19% | 2019-04-24 |
| CVE-2025-51471Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious…Ollama · Ollama · CVSS 6.9 · 2025-07-22 | 6.9 | 19% | 2025-07-22 |
| CVE-2025-52689Weak Session ID Check in the OmniAccess Stellar Web Management InterfaceAlcatel-Lucent · OmniAccess Stellar Products · CVSS 9.8 · 2025-07-16 | 9.8 | 17% | 2025-07-16 |
| CVE-2017-12965Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.Apache2triad · Apache2triad · 2017-08-23 | – | 16% | 2017-08-23 |
| CVE-2019-17563When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixat…Apache Software Foundation · Apache Tomcat · 2019-12-23 | – | 11% | 2019-12-23 |
| CVE-2017-6412In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.Sophos · Web Appliance · 2017-03-30 | – | 7.5% | 2017-03-30 |
| CVE-2021-36394In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.Moodle · Moodle · 2023-03-06 | – | 7.0% | 2023-03-06 |
| CVE-2017-5656Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token wh…Apache Software Foundation · Apache CXF · 2017-04-18 | – | 6.8% | 2017-04-18 |
| CVE-2015-4594eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it poss…Eclinicalworks · Population Health · 2017-01-10 | – | 6.2% | 2017-01-10 |
| CVE-2022-30605A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increa…WWBN · AVideo · CVSS 8.8 · 2022-08-22 | 8.8 | 5.0% | 2022-08-22 |
| CVE-2017-12619Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".Apache Software Foundation · Apache Zeppelin · 2019-04-23 | – | 4.9% | 2019-04-23 |
| CVE-2015-1820REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of coo…Rest-Client Project · Rest-Client · 2017-08-09 | – | 4.3% | 2017-08-09 |
| CVE-2018-5385Navarino Infinity web interface up to version 2.2 is prone to session fixation attacksNavarino · Infinity · 2018-07-24 | – | 4.0% | 2018-07-24 |
| CVE-2019-18418clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.Clonos · Clonos · 2019-10-24 | – | 4.0% | 2019-10-24 |
| CVE-2020-5645Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE Co…Mitsubishi Electric Corporation · GT14 Model of GOT 1000 series · 2020-11-06 | – | 3.9% | 2020-11-06 |
| CVE-2007-4188Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unspecified vectors.Joomla · Joomla! · 2007-08-08 | – | 3.8% | 2007-08-08 |
| CVE-2017-14263Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that sess…Honeywell · Enterprise Dvr Firmware · 2017-09-11 | – | 3.7% | 2017-09-11 |
| CVE-2018-0229A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mobility Client for Desktop Plat…Cisco · Cisco ASA Software, FTD Software, and AnyConnect Secure Mobility Client · 2018-04-19 | – | 3.4% | 2018-04-19 |
| CVE-2019-5523VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitati…VMware · VMware vCloud Director for Service Providers (vCD) · 2019-04-01 | – | 3.3% | 2019-04-01 |
| CVE-1999-0428OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.Openssl · Openssl · 2000-01-04 | – | 3.2% | 2000-01-04 |
| CVE-2018-18926Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaro…Gitea · Gitea · 2018-11-04 | – | 3.0% | 2018-11-04 |
| CVE-2015-1174Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id.Unit4 · Teta Web · 2017-08-02 | – | 2.9% | 2017-08-02 |
| CVE-2008-3222Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers…Drupal · Drupal · 2008-07-18 | – | 2.9% | 2008-07-18 |
| CVE-2019-11213In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end…Ivanti · Connect Secure · 2019-04-12 | – | 2.8% | 2019-04-12 |
| CVE-2020-5654Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number ar…Mitsubishi Electric Corporation · MELSEC iQ-R series · 2020-10-30 | – | 2.7% | 2020-10-30 |
| CVE-2016-9125Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session…Revive-Adserver · Revive Adserver All versions before 3.2.3 · 2017-03-28 | – | 2.7% | 2017-03-28 |
| CVE-2025-8517givanz Vvveb session fixiationgivanz · Vvveb · CVSS 6.3 · 2025-08-04 | 6.3 | 2.5% | 2025-08-04 |
| CVE-2016-0721Session fixation vulnerability in pcsd in pcs before 0.9.157.Clusterlabs · Pcs · 2017-04-21 | – | 2.4% | 2017-04-21 |
| CVE-2019-8116Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can leverage a…Adobe Systems Incorporated · Magento 2 · 2019-11-05 | – | 2.2% | 2019-11-05 |
| CVE-2020-15909SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against mul…Solarwinds · N-Central · 2020-10-19 | – | 2.2% | 2020-10-19 |
| CVE-2020-5543TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allows remote…Mitsubishi Electric Corporation · Mitsubishi Electric MELQIC IU1 series · 2020-03-16 | – | 2.2% | 2020-03-16 |
| CVE-2022-38054Session FixationApache Software Foundation · Apache Airflow · 2022-09-02 | – | 2.2% | 2022-09-02 |
| CVE-2020-11729An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely,…Davical · Andrew's Web Libraries · 2020-04-15 | – | 2.2% | 2020-04-15 |
| CVE-2013-4572The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autoc…Wikimedia Foundation · MediaWiki · 2020-02-06 | – | 2.1% | 2020-02-06 |
| CVE-2016-8638A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. Thi…Ipsilon Project · Ipsilon · 2017-07-12 | – | 2.1% | 2017-07-12 |
| CVE-2017-12868The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attac…Simplesamlphp · Simplesamlphp · 2017-09-01 | – | 2.1% | 2017-09-01 |
| CVE-2023-31498A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via t…Phpgurukul · Hospital Management System · CVSS 9.8 · 2023-05-11 | 9.8 | 2.1% | 2023-05-11 |
| CVE-2018-6959VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's…VMware · vRealize Automation · 2018-04-13 | – | 2.0% | 2018-04-13 |
| CVE-2018-11385An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session…Sensiolabs · Symfony · 2018-06-13 | – | 2.0% | 2018-06-13 |
| CVE-2019-10158A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrec…Red Hat · infinispan · CVSS 5.4 · 2020-01-02 | 5.4 | 2.0% | 2020-01-02 |
| CVE-2016-10405Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors.D-Link · Dir-600l Firmware · 2017-09-07 | – | 1.9% | 2017-09-07 |
| CVE-2018-1375IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnera…IBM · Security Guardium Big Data Intelligence · CVSS 5.9 · 2018-05-29 | 5.9 | 1.9% | 2018-05-29 |
| CVE-2020-5550Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to impersonate a registered user and log in…Plat'Home Co.,Ltd. · EasyBlocks IPv6 · 2020-04-08 | – | 1.9% | 2020-04-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.