Drupal core having issues as cross-Site Request Forgery and session identifier not updated

I have did testing for user login modules using IBM Appscan Tools its shows the
error
Cross-Site Request Forgery,
Session Identifier Not Updated and
Autocomplete HTML Attribute Not Disabled for Password Field