CWE-613 · Insufficient Session Expiration (page 5)
Page 5 of 6 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30698 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting a… |
CVE-2022-31145 | Medium | 6.5 | 2022-07-13 | FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated… |
CVE-2022-33137 | High | 8.0 | 2022-07-12 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIM… |
CVE-2022-2306 | High | 7.5 | 2022-07-05 | Old session tokens can be used to authenticate to the application and send authenticated requests. |
CVE-2022-22318 | Critical | 9.8 | 2022-06-20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another use… |
CVE-2022-22317 | Critical | 9.8 | 2022-06-20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another use… |
CVE-2022-31050 | Medium | 6.0 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend… |
CVE-2022-2064 | High | 8.8 | 2022-06-13 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-30277 | Medium | 5.7 | 2022-06-02 | BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, m… |
CVE-2022-23669 | High | 8.8 | 2022-05-17 | A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below… |
CVE-2022-24042 | Critical | 9.1 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-27751 | Medium | 4.4 | 2022-05-06 | HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are st… |
CVE-2022-23063 | High | 8.8 | 2022-05-03 | In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a u… |
CVE-2021-3461 | High | 7.1 | 2022-04-01 | A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type… |
CVE-2022-25590 | Medium | 6.5 | 2022-03-25 | SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cac… |
CVE-2022-0991 | High | 7.1 | 2022-03-19 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. |
CVE-2022-24743 | High | 7.1 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed… |
CVE-2022-24744 | Low | 2.6 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged ou… |
CVE-2022-24732 | Medium | 6.3 | 2022-03-09 | Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking… |
CVE-2021-38986 | Medium | 5.4 | 2022-03-01 | IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system… |
CVE-2022-24341 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. |
CVE-2022-24332 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. |
CVE-2021-25992 | Critical | 9.8 | 2022-02-10 | In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to re… |
CVE-2021-22820 | Critical | 9.8 | 2022-01-28 | A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the c… |
CVE-2021-29846 | Low | 2.7 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 20… |
CVE-2021-37866 | Medium | 4.7 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reu… |
CVE-2022-22113 | High | 8.8 | 2022-01-13 | In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an… |
CVE-2022-22283 | Low | 2.8 | 2022-01-10 | Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. |
CVE-2022-21652 | Low | 3.5 | 2022-01-05 | Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. W… |
CVE-2021-25981 | Critical | 9.8 | 2022-01-03 | In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration… |
CVE-2021-45885 | High | 7.5 | 2021-12-29 | An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH p… |
CVE-2021-35034 | High | 7.4 | 2021-12-29 | An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the cor… |
CVE-2020-27416 | Critical | 9.8 | 2021-12-08 | Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users acco… |
CVE-2021-43791 | Medium | 6.5 | 2021-12-02 | Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmat… |
CVE-2021-36330 | High | 8.1 | 2021-11-30 | Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentiall… |
CVE-2021-42545 | High | 8.1 | 2021-11-30 | An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to… |
CVE-2021-25985 | High | 7.8 | 2021-11-16 | In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition… |
CVE-2021-25940 | High | 8.8 | 2021-11-16 | In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the sess… |
CVE-2021-25979 | Critical | 9.8 | 2021-11-08 | Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation… |
CVE-2021-41247 | Low | 3.5 | 2021-11-04 | JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser ses… |
CVE-2021-34739 | High | 8.1 | 2021-11-04 | A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to repla… |
CVE-2021-40849 | Critical | 9.8 | 2021-11-03 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, res… |
CVE-2021-29868 | Medium | 5.5 | 2021-10-27 | IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213. |
CVE-2021-25970 | High | 8.8 | 2021-10-20 | Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged… |
CVE-2021-35214 | Medium | 4.8 | 2021-10-12 | The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple a… |
CVE-2021-25966 | High | 8.8 | 2021-10-10 | In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password… |
CVE-2021-20473 | Medium | 6.5 | 2021-10-07 | IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonat… |
CVE-2021-24019 | High | 8.1 | 2021-10-06 | An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unex… |
CVE-2021-41100 | High | 7.4 | 2021-10-04 | Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of… |
CVE-2021-38823 | Critical | 9.8 | 2021-10-04 | The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is ope… |
CVE-2021-37333 | Critical | 9.8 | 2021-10-04 | Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not… |
CVE-2021-33982 | High | 7.5 | 2021-09-08 | An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spo… |
CVE-2020-29012 | Medium | 5.6 | 2021-09-08 | An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs t… |
CVE-2021-39113 | High | 7.5 | 2021-08-30 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, v… |
CVE-2021-35342 | High | 7.5 | 2021-08-27 | The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows us… |
CVE-2021-30943 | Medium | 4.3 | 2021-08-24 | An issue in the handling of group membership was resolved with improved logic. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12… |
CVE-2021-37693 | Medium | 5.3 | 2021-08-13 | Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an… |
CVE-2021-37156 | High | 7.5 | 2021-08-05 | Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is f… |
CVE-2021-33322 | High | 7.5 | 2021-08-03 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not i… |
CVE-2021-20431 | Medium | 6.5 | 2021-07-26 | IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive informa… |
CVE-2021-20378 | High | 8.8 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another… |
CVE-2021-26037 | Medium | 5.3 | 2021-07-07 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or th… |
CVE-2021-34428 | Low | 2.9 | 2021-06-22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID i… |
CVE-2021-22221 | Medium | 6.5 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versi… |
CVE-2021-32923 | High | 7.4 | 2021-06-03 | HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their… |
CVE-2020-10709 | High | 7.1 | 2021-05-27 | A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication… |
CVE-2021-22136 | Low | 3.5 | 2021-05-13 | In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being resp… |
CVE-2021-1501 | High | 8.6 | 2021-04-29 | A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2021-31408 | Medium | 6.3 | 2021-04-23 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses… |
CVE-2019-3867 | Medium | 4.1 | 2021-03-18 | A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could… |
CVE-2020-35358 | Critical | 9.8 | 2021-03-15 | DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password a… |
CVE-2009-20001 | High | 8.1 | 2021-03-07 | An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user se… |
CVE-2021-3144 | Critical | 9.1 | 2021-02-27 | In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) |
CVE-2021-27351 | Medium | 5.3 | 2021-02-19 | The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently act… |
CVE-2021-21032 | Medium | 5.6 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of thi… |
CVE-2021-21031 | Medium | 5.6 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could… |
CVE-2021-26921 | Medium | 6.5 | 2021-02-09 | In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled. |
CVE-2020-4995 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from… |
CVE-2020-6649 | Critical | 9.8 | 2021-02-08 | An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user se… |
CVE-2021-3311 | Critical | 9.8 | 2021-02-05 | An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: t… |
CVE-2020-14247 | Medium | 6.5 | 2021-02-04 | HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID. |
CVE-2021-3183 | High | 7.5 | 2021-01-19 | Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login profile. |
CVE-2020-15220 | Medium | 6.1 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a… |
CVE-2020-15218 | Medium | 6.8 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after… |
CVE-2016-20007 | High | 7.5 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory… |
CVE-2020-29667 | Critical | 9.8 | 2020-12-10 | In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control o… |
CVE-2020-4696 | Medium | 4.3 | 2020-11-30 | IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from… |
CVE-2020-13353 | Low | 2.5 | 2020-11-17 | When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. |
CVE-2020-27422 | Critical | 9.8 | 2020-11-16 | In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeove… |
CVE-2020-23140 | High | 8.1 | 2020-11-09 | Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any… |
CVE-2020-23136 | Medium | 5.5 | 2020-11-09 | Microweber v1.1.18 is affected by no session expiry after log-out. |
CVE-2020-15950 | High | 8.8 | 2020-11-05 | Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout. |
CVE-2020-25374 | Low | 2.6 | 2020-10-28 | CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle t… |
CVE-2020-24713 | High | 7.5 | 2020-10-28 | Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. |
CVE-2020-27739 | Critical | 9.8 | 2020-10-28 | A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOT… |
CVE-2020-15269 | High | 7.4 | 2020-10-20 | In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3… |
CVE-2020-1666 | Medium | 6.6 | 2020-10-16 | The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console ca… |
CVE-2020-6363 | Medium | 4.6 | 2020-10-15 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established afte… |
CVE-2020-4395 | Medium | 5.4 | 2020-10-14 | IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the… |
CVE-2020-4780 | Medium | 5.3 | 2020-10-12 | OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of th… |