CWE-613 · Insufficient Session Expiration (page 5)
Page 5 of 7 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31065 | Critical | 9.1 | 2023-05-22 | Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old… |
CVE-2023-33005 | Medium | 5.4 | 2023-05-16 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. |
CVE-2023-31139 | Medium | 4.3 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1… |
CVE-2023-31140 | Medium | 4.8 | 2023-05-08 | OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first… |
CVE-2020-4914 | Medium | 4.2 | 2023-05-05 | IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the s… |
CVE-2022-38707 | Medium | 4.0 | 2023-05-05 | IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 23417… |
CVE-2023-30403 | High | 7.5 | 2023-05-02 | An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting… |
CVE-2023-28003 | Medium | 6.7 | 2023-04-18 | A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME… |
CVE-2022-37186 | Medium | 5.9 | 2023-04-16 | In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur whe… |
CVE-2023-1788 | Critical | 9.8 | 2023-04-05 | Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6. |
CVE-2023-1854 | Medium | 4.7 | 2023-04-05 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the fil… |
CVE-2023-20903 | Medium | 4.3 | 2023-03-28 | This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to… |
CVE-2021-3844 | Medium | 5.7 | 2023-03-24 | Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For examp… |
CVE-2023-1543 | High | 8.8 | 2023-03-21 | Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-22591 | Low | 3.9 | 2023-03-15 | IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for… |
CVE-2023-27891 | High | 7.5 | 2023-03-06 | rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1. |
CVE-2023-23929 | High | 8.8 | 2023-03-04 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh… |
CVE-2023-22771 | Medium | 6.8 | 2023-03-01 | An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker… |
CVE-2022-48317 | Medium | 5.6 | 2023-02-20 | Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired sess… |
CVE-2023-25562 | Medium | 6.9 | 2023-02-11 | DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout ev… |
CVE-2022-34392 | Medium | 5.5 | 2023-02-11 | SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able t… |
CVE-2022-24895 | Medium | 6.3 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the… |
CVE-2023-24426 | High | 8.8 | 2023-01-26 | Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. |
CVE-2023-23614 | High | 8.8 | 2023-01-26 | Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to… |
CVE-2023-22732 | Low | 3.7 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker… |
CVE-2023-0227 | Medium | 6.5 | 2023-01-12 | Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. |
CVE-2023-22492 | Medium | 5.9 | 2023-01-11 | ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the us… |
CVE-2022-46177 | Medium | 5.7 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2022-43844 | High | 8.8 | 2023-01-05 | IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform… |
CVE-2022-22371 | Medium | 5.5 | 2023-01-05 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated use… |
CVE-2022-47406 | Medium | 5.4 | 2022-12-14 | An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fa… |
CVE-2022-23502 | Medium | 5.4 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the c… |
CVE-2022-40228 | Low | 3.7 | 2022-11-22 | IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidat… |
CVE-2022-36179 | Critical | 9.8 | 2022-11-22 | Fusiondirectory 1.3 suffers from Improper Session Handling. |
CVE-2022-4070 | Critical | 9.8 | 2022-11-20 | Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3362 | Critical | 9.8 | 2022-11-14 | Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0. |
CVE-2022-3867 | Low | 2.7 | 2022-11-10 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed… |
CVE-2022-40230 | Medium | 6.5 | 2022-11-03 | "IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another… |
CVE-2022-39234 | Medium | 4.7 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-2782 | Critical | 9.1 | 2022-10-27 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. |
CVE-2021-46279 | Medium | 5.8 | 2022-10-24 | Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: L… |
CVE-2022-41542 | Medium | 5.4 | 2022-10-17 | devhub 0.102.0 was discovered to contain a broken session control. |
CVE-2022-41291 | Medium | 6.5 | 2022-10-07 | IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the syst… |
CVE-2022-41672 | High | 8.1 | 2022-10-07 | In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. |
CVE-2019-5641 | Low | 3.3 | 2022-09-21 | Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Eleme… |
CVE-2022-2888 | Medium | 4.4 | 2022-09-21 | If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as lon… |
CVE-2022-3080 | High | 7.5 | 2022-09-21 | By sending specific queries to the resolver, an attacker can cause named to crash. |
CVE-2022-31677 | Medium | 5.4 | 2022-08-29 | An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinni… |
CVE-2022-34624 | Medium | 5.9 | 2022-08-19 | Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request. |
CVE-2022-2713 | Critical | 9.8 | 2022-08-08 | Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. |
CVE-2022-35728 | High | 8.1 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ versi… |
CVE-2022-30699 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting… |
CVE-2022-30698 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting a… |
CVE-2022-31145 | Medium | 6.5 | 2022-07-13 | FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated… |
CVE-2022-33137 | High | 8.0 | 2022-07-12 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIM… |
CVE-2022-2306 | High | 7.5 | 2022-07-05 | Old session tokens can be used to authenticate to the application and send authenticated requests. |
CVE-2022-22318 | Critical | 9.8 | 2022-06-20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another use… |
CVE-2022-22317 | Critical | 9.8 | 2022-06-20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another use… |
CVE-2022-31050 | Medium | 6.0 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend… |
CVE-2022-2064 | High | 8.8 | 2022-06-13 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-30277 | Medium | 5.7 | 2022-06-02 | BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, m… |
CVE-2022-23669 | High | 8.8 | 2022-05-17 | A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below… |
CVE-2022-24042 | Critical | 9.1 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-27751 | Medium | 4.4 | 2022-05-06 | HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are st… |
CVE-2022-23063 | High | 8.8 | 2022-05-03 | In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a u… |
CVE-2021-3461 | High | 7.1 | 2022-04-01 | A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type… |
CVE-2022-25590 | Medium | 6.5 | 2022-03-25 | SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cac… |
CVE-2022-0991 | High | 7.1 | 2022-03-19 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. |
CVE-2022-24743 | High | 7.1 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed… |
CVE-2022-24744 | Low | 2.6 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged ou… |
CVE-2022-24732 | Medium | 6.3 | 2022-03-09 | Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking… |
CVE-2021-38986 | Medium | 5.4 | 2022-03-01 | IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system… |
CVE-2022-24341 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. |
CVE-2022-24332 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. |
CVE-2021-25992 | Critical | 9.8 | 2022-02-10 | In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to re… |
CVE-2021-22820 | Critical | 9.8 | 2022-01-28 | A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the c… |
CVE-2021-29846 | Low | 2.7 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 20… |
CVE-2021-37866 | Medium | 4.7 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reu… |
CVE-2022-22113 | High | 8.8 | 2022-01-13 | In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an… |
CVE-2022-22283 | Low | 2.8 | 2022-01-10 | Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. |
CVE-2022-21652 | Low | 3.5 | 2022-01-05 | Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. W… |
CVE-2021-25981 | Critical | 9.8 | 2022-01-03 | In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration… |
CVE-2021-45885 | High | 7.5 | 2021-12-29 | An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH p… |
CVE-2021-35034 | High | 7.4 | 2021-12-29 | An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the cor… |
CVE-2020-27416 | Critical | 9.8 | 2021-12-08 | Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users acco… |
CVE-2021-43791 | Medium | 6.5 | 2021-12-02 | Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmat… |
CVE-2021-36330 | High | 8.1 | 2021-11-30 | Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentiall… |
CVE-2021-42545 | High | 8.1 | 2021-11-30 | An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to… |
CVE-2021-25985 | High | 7.8 | 2021-11-16 | In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition… |
CVE-2021-25940 | High | 8.8 | 2021-11-16 | In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the sess… |
CVE-2021-25979 | Critical | 9.8 | 2021-11-08 | Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation… |
CVE-2021-41247 | Low | 3.5 | 2021-11-04 | JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser ses… |
CVE-2021-34739 | High | 8.1 | 2021-11-04 | A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to repla… |
CVE-2021-40849 | Critical | 9.8 | 2021-11-03 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, res… |
CVE-2021-29868 | Medium | 5.5 | 2021-10-27 | IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213. |
CVE-2021-25970 | High | 8.8 | 2021-10-20 | Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged… |
CVE-2021-35214 | Medium | 4.8 | 2021-10-12 | The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple a… |
CVE-2021-25966 | High | 8.8 | 2021-10-10 | In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password… |
CVE-2021-20473 | Medium | 6.5 | 2021-10-07 | IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonat… |
CVE-2021-24019 | High | 8.1 | 2021-10-06 | An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unex… |