CWE-613 · Insufficient Session Expiration (page 4)
Page 4 of 7 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35473 | Critical | 9.1 | 2024-11-10 | An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token vali… |
CVE-2024-52311 | Medium | 6.3 | 2024-11-09 | Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of author… |
CVE-2024-48926 | Medium | 4.2 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10… |
CVE-2024-45462 | Medium | 6.3 | 2024-10-16 | The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend… |
CVE-2024-48827 | High | 8.8 | 2024-10-11 | An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function. |
CVE-2024-46040 | Medium | 6.5 | 2024-10-07 | IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT… |
CVE-2024-43685 | Critical | 9.8 | 2024-10-04 | Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 be… |
CVE-2024-23586 | Medium | 5.3 | 2024-09-27 | HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old sessi… |
CVE-2024-8888 | Critical | 10.0 | 2024-09-18 | An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have… |
CVE-2024-38315 | Medium | 6.3 | 2024-09-16 | IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user… |
CVE-2024-32006 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application does not expire the user session on reb… |
CVE-2024-45187 | High | 7.1 | 2024-08-23 | Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access… |
CVE-2024-7998 | Low | 2.6 | 2024-08-21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan. |
CVE-2024-39809 | High | 7.5 | 2024-08-14 | The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support (EoTS… |
CVE-2022-45862 | Low | 3.7 | 2024-08-13 | An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all ver… |
CVE-2022-38382 | Medium | 4.7 | 2024-08-13 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout… |
CVE-2024-42447 | Critical | 9.8 | 2024-08-05 | Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache A… |
CVE-2023-26288 | Medium | 5.5 | 2024-07-30 | IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the sy… |
CVE-2022-32759 | Medium | 5.3 | 2024-07-25 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 uses insufficient session expiration which could allow an unauthori… |
CVE-2024-29070 | Critical | 9.1 | 2024-07-23 | On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the fro… |
CVE-2024-41827 | High | 7.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration |
CVE-2024-27782 | High | 8.1 | 2024-07-09 | Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tok… |
CVE-2024-36041 | High | 7.8 | 2024-07-05 | KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all… |
CVE-2024-5995 | High | 8.8 | 2024-06-14 | The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remainin… |
CVE-2024-36523 | Medium | 6.5 | 2024-06-12 | An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own or administrator acco… |
CVE-2024-35206 | High | 7.7 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not expire the session… |
CVE-2024-4680 | High | 8.8 | 2024-06-08 | A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Speci… |
CVE-2024-35220 | High | 7.4 | 2024-05-21 | @fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is… |
CVE-2024-35050 | High | 8.8 | 2024-05-14 | An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin. |
CVE-2024-35049 | Critical | 9.1 | 2024-05-14 | SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590. |
CVE-2024-35048 | Medium | 4.3 | 2024-05-14 | An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password. |
CVE-2024-34709 | Medium | 5.4 | 2024-05-14 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they… |
CVE-2024-34092 | High | 8.8 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0… |
CVE-2023-40695 | Medium | 6.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user o… |
CVE-2024-29402 | Medium | 4.3 | 2024-04-16 | cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity. |
CVE-2024-22358 | Medium | 6.3 | 2024-04-12 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does… |
CVE-2024-31999 | High | 7.4 | 2024-04-10 | @festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with… |
CVE-2024-31995 | Medium | 4.3 | 2024-04-10 | `@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a ch… |
CVE-2024-30262 | Medium | 5.9 | 2024-04-09 | Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the passwor… |
CVE-2024-31447 | Medium | 5.3 | 2024-04-08 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authe… |
CVE-2024-25954 | Medium | 5.3 | 2024-03-28 | Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could pote… |
CVE-2024-29401 | Critical | 9.8 | 2024-03-26 | xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything. |
CVE-2024-1623 | High | 7.7 | 2024-03-14 | Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the admi… |
CVE-2024-20301 | Medium | 6.2 | 2024-03-06 | A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and ac… |
CVE-2024-1900 | Medium | 5.5 | 2024-03-05 | Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an iden… |
CVE-2023-45600 | Medium | 5.6 | 2024-03-05 | A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session… |
CVE-2024-21722 | Medium | 6.3 | 2024-02-29 | The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified. |
CVE-2024-22543 | Medium | 6.1 | 2024-02-27 | An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET request to the /gofor… |
CVE-2024-27455 | Critical | 9.1 | 2024-02-26 | In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files… |
CVE-2023-50270 | Medium | 6.5 | 2024-02-20 | Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to ver… |
CVE-2024-21492 | Medium | 4.8 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon… |
CVE-2024-25628 | High | 7.6 | 2024-02-16 | Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalida… |
CVE-2024-25619 | Low | 3.1 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed… |
CVE-2024-0008 | Medium | 6.6 | 2024-02-14 | Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized acces… |
CVE-2024-22389 | High | 7.2 | 2024-02-14 | When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software ve… |
CVE-2024-25718 | Critical | 9.8 | 2024-02-11 | In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Sam… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2023-45187 | Medium | 6.3 | 2024-02-09 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to imperso… |
CVE-2023-50936 | Medium | 6.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM… |
CVE-2024-0944 | Low | 3.7 | 2024-01-26 | A vulnerability was found in Totolink T8 4.1.5cu.833_20220905. It has been rated as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-0943 | Low | 3.7 | 2024-01-26 | A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-0942 | Low | 3.7 | 2024-01-26 | A vulnerability was found in Totolink N200RE V5 9.3.5u.6255_B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-… |
CVE-2024-22403 | Low | 3.0 | 2024-01-18 | Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization… |
CVE-2024-0350 | Low | 3.1 | 2024-01-09 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2024-0260 | Medium | 4.3 | 2024-01-07 | A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file chan… |
CVE-2023-51772 | High | 8.8 | 2023-12-25 | One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a… |
CVE-2023-4320 | High | 7.6 | 2023-12-18 | An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to… |
CVE-2023-49935 | High | 8.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can r… |
CVE-2023-46326 | High | 8.8 | 2023-11-30 | ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to p… |
CVE-2023-49091 | High | 8.8 | 2023-11-29 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vuln… |
CVE-2023-47628 | Medium | 4.2 | 2023-11-14 | DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do… |
CVE-2023-5889 | High | 8.2 | 2023-11-01 | Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-39695 | Medium | 5.3 | 2023-10-31 | Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging o… |
CVE-2023-5865 | Critical | 9.8 | 2023-10-31 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5838 | Critical | 9.8 | 2023-10-29 | Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9. |
CVE-2023-46158 | Medium | 4.9 | 2023-10-25 | IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling… |
CVE-2023-37504 | High | 7.1 | 2023-10-19 | HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is calle… |
CVE-2021-20581 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 19… |
CVE-2023-45659 | Low | 3.6 | 2023-10-17 | Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged i… |
CVE-2023-33303 | High | 8.1 | 2023-10-13 | A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request |
CVE-2023-42768 | High | 7.2 | 2023-10-10 | When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role… |
CVE-2023-40537 | High | 8.1 | 2023-10-10 | An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION pl… |
CVE-2022-3916 | Medium | 6.8 | 2023-09-20 | A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due t… |
CVE-2023-40732 | Low | 3.9 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the sessio… |
CVE-2023-41041 | Low | 2.6 | 2023-08-30 | Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used f… |
CVE-2023-40178 | Medium | 5.3 | 2023-08-23 | Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reuse… |
CVE-2023-40025 | Medium | 4.7 | 2023-08-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web termina… |
CVE-2023-40174 | Medium | 6.8 | 2023-08-18 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a… |
CVE-2023-37570 | High | 7.2 | 2023-08-08 | This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker coul… |
CVE-2023-4190 | Medium | 6.5 | 2023-08-06 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. |
CVE-2023-4126 | High | 8.8 | 2023-08-03 | Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0. |
CVE-2023-4005 | Critical | 9.8 | 2023-07-31 | Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. |
CVE-2023-38489 | High | 7.3 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user acco… |
CVE-2023-37919 | Medium | 6.5 | 2023-07-25 | Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When ac… |
CVE-2023-28001 | Medium | 4.1 | 2023-07-11 | An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing… |
CVE-2023-36252 | High | 8.8 | 2023-06-26 | An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the… |
CVE-2023-35857 | Critical | 9.8 | 2023-06-19 | In Siren Investigate before 13.2.2, session keys remain active even after logging out. |
CVE-2023-2788 | Medium | 6.2 | 2023-06-16 | Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent acce… |
CVE-2023-0041 | Medium | 6.3 | 2023-06-05 | IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657. |
CVE-2023-32318 | High | 7.2 | 2023-05-26 | Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruc… |