CWE-613 · Insufficient Session Expiration (page 4)
Page 4 of 6 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25619 | Low | 3.1 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed… |
CVE-2024-0008 | Medium | 6.6 | 2024-02-14 | Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized acces… |
CVE-2024-22389 | High | 7.2 | 2024-02-14 | When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software ve… |
CVE-2024-25718 | Critical | 9.8 | 2024-02-11 | In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Sam… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2023-45187 | Medium | 6.3 | 2024-02-09 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to imperso… |
CVE-2023-50936 | Medium | 6.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM… |
CVE-2024-0944 | Low | 3.7 | 2024-01-26 | A vulnerability was found in Totolink T8 4.1.5cu.833_20220905. It has been rated as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-0943 | Low | 3.7 | 2024-01-26 | A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-0942 | Low | 3.7 | 2024-01-26 | A vulnerability was found in Totolink N200RE V5 9.3.5u.6255_B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-… |
CVE-2024-22403 | Low | 3.0 | 2024-01-18 | Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization… |
CVE-2024-0350 | Low | 3.1 | 2024-01-09 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2024-0260 | Medium | 4.3 | 2024-01-07 | A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file chan… |
CVE-2023-51772 | High | 8.8 | 2023-12-25 | One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a… |
CVE-2023-4320 | High | 7.6 | 2023-12-18 | An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to… |
CVE-2023-49935 | High | 8.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can r… |
CVE-2023-46326 | High | 8.8 | 2023-11-30 | ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to p… |
CVE-2023-49091 | High | 8.8 | 2023-11-29 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vuln… |
CVE-2023-47628 | Medium | 4.2 | 2023-11-14 | DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do… |
CVE-2023-5889 | High | 8.2 | 2023-11-01 | Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-39695 | Medium | 5.3 | 2023-10-31 | Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging o… |
CVE-2023-5865 | Critical | 9.8 | 2023-10-31 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5838 | Critical | 9.8 | 2023-10-29 | Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9. |
CVE-2023-46158 | Medium | 4.9 | 2023-10-25 | IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling… |
CVE-2023-37504 | High | 7.1 | 2023-10-19 | HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is calle… |
CVE-2021-20581 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 19… |
CVE-2023-45659 | Low | 3.6 | 2023-10-17 | Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged i… |
CVE-2023-33303 | High | 8.1 | 2023-10-13 | A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request |
CVE-2023-42768 | High | 7.2 | 2023-10-10 | When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role… |
CVE-2023-40537 | High | 8.1 | 2023-10-10 | An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION pl… |
CVE-2022-3916 | Medium | 6.8 | 2023-09-20 | A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due t… |
CVE-2023-40732 | Low | 3.9 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the sessio… |
CVE-2023-41041 | Low | 2.6 | 2023-08-30 | Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used f… |
CVE-2023-40178 | Medium | 5.3 | 2023-08-23 | Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reuse… |
CVE-2023-40025 | Medium | 4.7 | 2023-08-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web termina… |
CVE-2023-40174 | Medium | 6.8 | 2023-08-18 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a… |
CVE-2023-37570 | High | 7.2 | 2023-08-08 | This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker coul… |
CVE-2023-4190 | Medium | 6.5 | 2023-08-06 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. |
CVE-2023-4126 | High | 8.8 | 2023-08-03 | Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0. |
CVE-2023-4005 | Critical | 9.8 | 2023-07-31 | Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. |
CVE-2023-38489 | High | 7.3 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user acco… |
CVE-2023-37919 | Medium | 6.5 | 2023-07-25 | Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When ac… |
CVE-2023-28001 | Medium | 4.1 | 2023-07-11 | An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing… |
CVE-2023-36252 | High | 8.8 | 2023-06-26 | An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the… |
CVE-2023-35857 | Critical | 9.8 | 2023-06-19 | In Siren Investigate before 13.2.2, session keys remain active even after logging out. |
CVE-2023-2788 | Medium | 6.2 | 2023-06-16 | Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent acce… |
CVE-2023-0041 | Medium | 6.3 | 2023-06-05 | IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657. |
CVE-2023-32318 | High | 7.2 | 2023-05-26 | Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruc… |
CVE-2023-31065 | Critical | 9.1 | 2023-05-22 | Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old… |
CVE-2023-33005 | Medium | 5.4 | 2023-05-16 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. |
CVE-2023-31139 | Medium | 4.3 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1… |
CVE-2023-31140 | Medium | 4.8 | 2023-05-08 | OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first… |
CVE-2020-4914 | Medium | 4.2 | 2023-05-05 | IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the s… |
CVE-2022-38707 | Medium | 4.0 | 2023-05-05 | IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 23417… |
CVE-2023-30403 | High | 7.5 | 2023-05-02 | An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting… |
CVE-2023-28003 | Medium | 6.7 | 2023-04-18 | A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME… |
CVE-2022-37186 | Medium | 5.9 | 2023-04-16 | In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur whe… |
CVE-2023-1788 | Critical | 9.8 | 2023-04-05 | Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6. |
CVE-2023-1854 | Medium | 4.7 | 2023-04-05 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the fil… |
CVE-2023-20903 | Medium | 4.3 | 2023-03-28 | This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to… |
CVE-2021-3844 | Medium | 5.7 | 2023-03-24 | Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For examp… |
CVE-2023-1543 | High | 8.8 | 2023-03-21 | Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-22591 | Low | 3.9 | 2023-03-15 | IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for… |
CVE-2023-27891 | High | 7.5 | 2023-03-06 | rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1. |
CVE-2023-23929 | High | 8.8 | 2023-03-04 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh… |
CVE-2023-22771 | Medium | 6.8 | 2023-03-01 | An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker… |
CVE-2022-48317 | Medium | 5.6 | 2023-02-20 | Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired sess… |
CVE-2023-25562 | Medium | 6.9 | 2023-02-11 | DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout ev… |
CVE-2022-34392 | Medium | 5.5 | 2023-02-11 | SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able t… |
CVE-2022-24895 | Medium | 6.3 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the… |
CVE-2023-24426 | High | 8.8 | 2023-01-26 | Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. |
CVE-2023-23614 | High | 8.8 | 2023-01-26 | Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to… |
CVE-2023-22732 | Low | 3.7 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker… |
CVE-2023-0227 | Medium | 6.5 | 2023-01-12 | Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. |
CVE-2023-22492 | Medium | 5.9 | 2023-01-11 | ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the us… |
CVE-2022-46177 | Medium | 5.7 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2022-43844 | High | 8.8 | 2023-01-05 | IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform… |
CVE-2022-22371 | Medium | 5.5 | 2023-01-05 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated use… |
CVE-2022-47406 | Medium | 5.4 | 2022-12-14 | An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fa… |
CVE-2022-23502 | Medium | 5.4 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the c… |
CVE-2022-40228 | Low | 3.7 | 2022-11-22 | IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidat… |
CVE-2022-36179 | Critical | 9.8 | 2022-11-22 | Fusiondirectory 1.3 suffers from Improper Session Handling. |
CVE-2022-4070 | Critical | 9.8 | 2022-11-20 | Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3362 | Critical | 9.8 | 2022-11-14 | Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0. |
CVE-2022-3867 | Low | 2.7 | 2022-11-10 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed… |
CVE-2022-40230 | Medium | 6.5 | 2022-11-03 | "IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another… |
CVE-2022-39234 | Medium | 4.7 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-2782 | Critical | 9.1 | 2022-10-27 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. |
CVE-2021-46279 | Medium | 5.8 | 2022-10-24 | Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: L… |
CVE-2022-41542 | Medium | 5.4 | 2022-10-17 | devhub 0.102.0 was discovered to contain a broken session control. |
CVE-2022-41291 | Medium | 6.5 | 2022-10-07 | IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the syst… |
CVE-2022-41672 | High | 8.1 | 2022-10-07 | In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. |
CVE-2019-5641 | Low | 3.3 | 2022-09-21 | Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Eleme… |
CVE-2022-2888 | Medium | 4.4 | 2022-09-21 | If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as lon… |
CVE-2022-3080 | High | 7.5 | 2022-09-21 | By sending specific queries to the resolver, an attacker can cause named to crash. |
CVE-2022-31677 | Medium | 5.4 | 2022-08-29 | An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinni… |
CVE-2022-34624 | Medium | 5.9 | 2022-08-19 | Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request. |
CVE-2022-2713 | Critical | 9.8 | 2022-08-08 | Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. |
CVE-2022-35728 | High | 8.1 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ versi… |
CVE-2022-30699 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting… |