CVE-2018-1626

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 144411.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-384

Affected software

VendorProductVersions
IBMSecurity Privileged Identity Manager2.1.1

References

Timeline

Published
Apr 2, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-162616.8In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate TrCVE-2018-162628.8The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security poliCVE-2018-162638.8The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security poliCVE-2018-162646.5The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to impCVE-2018-162656.5The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing prCVE-2018-162668.1The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus securityCVE-2018-162678.1The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus securCVE-2018-162684.3The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper CVE-2018-162697.5The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, dCVE-2018-162707.5Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unpriviCVE-2018-162716.5The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulatCVE-2018-162729.8The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to
CVE-2018-1626: Medium severity, CVSS 4.3 | Vulnix