TYPE DE FAIBLESSE

Fixation de session CWE-384

30 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-384 (en anglais) →

CVE-2026-105233Le système kishor-23 food-waste-management-system est susceptible d'une fixation de session via le fichier `login.php`. Un attaquant peut détourner à distance la session d'un utili… 2.1 FAIBLE

CVE-2026-86674Le système de gestion scolaire ningzichun est vulnérable à la fixation de session via la page de connexion. Un attaquant distant peut détourner la session d'un utilisateur, mais se… 2.1 FAIBLE

CVE-2026-14609Le système de notation automatisé SourceCodester CET (v1.0) est susceptible d'être victime d'une fixation de session, ce qui pourrait permettre à un attaquant distant de détourner … 2.9 FAIBLE

CVE-2026-13707Les serveurs OAuth de la Fondation Wikimedia (versions 1.46.0, 1.45.4, 1.44.6, 1.43.9 et versions antérieures) sont vulnérables à la fixation de session. Un attaquant disposant d'u… 0.0 AUCUNE

CVE-2026-11335Le système de gestion du collège Tittuvarghese est vulnérable à la fixation de session via le formulaire de connexion. Un attaquant distant peut détourner la session d'un utilisate… 2.1 FAIBLE

CVE-2026-34454Les versions 7.11.0 à 7.15.1 d'OAuth2 Proxy ne suppriment pas les cookies de session lors de l'affichage de la page de connexion, ce qui signifie que les utilisateurs ne sont pas r… 3.5 FAIBLE

CVE-2025-43516A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with Voice Control enabled… 3.3 FAIBLE

CVE-2025-65681An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence o… 3.3 FAIBLE

CVE-2025-56746Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user … 2.2 FAIBLE

CVE-2025-8517A vulnerability was detected in givanz Vvveb 1.0.6.1. Impacted is an unknown function. The manipulation results in session fixiation. The attack can be launched remotely. The explo… 2.1 FAIBLE

CVE-2025-0253HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabi… 2.0 FAIBLE

CVE-2025-0251HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks. 2.6 FAIBLE

CVE-2024-49709Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser might set such a cookie,… 2.3 FAIBLE

CVE-2025-1412Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their priv… 3.1 FAIBLE

CVE-2023-45718Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, coo… 3.9 FAIBLE

CVE-2024-0351A vulnerability classified as problematic has been found in SourceCodester Engineers Online Portal 1.0. This affects an unknown part. The manipulation leads to session fixiation. I… 3.1 FAIBLE

CVE-2020-4243IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle techniques due to no… 3.7 FAIBLE

CVE-2020-1993The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to con… 3.7 FAIBLE

CVE-2020-6824Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user ha… 2.8 FAIBLE

CVE-2018-1626IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking … 3.1 FAIBLE

CVE-2018-1804IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow… 3.7 FAIBLE

CVE-2018-1485IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vu… 3.1 FAIBLE

CVE-2018-1484IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie… 3.7 FAIBLE

CVE-2018-16463A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares. 3.1 FAIBLE

CVE-2016-8609It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack… 3.7 FAIBLE

CVE-2018-11567Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an inp… 3.3 FAIBLE

CVE-2017-1270IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user… 3.3 FAIBLE

CVE-2017-0892Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file. 3.5 FAIBLE

CVE-2016-9703IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensiti… 2.4 FAIBLE

CVE-2001-1534mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local … 2.1 FAIBLE