CWE-613 · Insufficient Session Expiration (page 6)
Page 6 of 7 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41100 | High | 7.4 | 2021-10-04 | Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of… |
CVE-2021-38823 | Critical | 9.8 | 2021-10-04 | The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is ope… |
CVE-2021-37333 | Critical | 9.8 | 2021-10-04 | Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not… |
CVE-2021-33982 | High | 7.5 | 2021-09-08 | An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spo… |
CVE-2020-29012 | Medium | 5.6 | 2021-09-08 | An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs t… |
CVE-2021-39113 | High | 7.5 | 2021-08-30 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, v… |
CVE-2021-35342 | High | 7.5 | 2021-08-27 | The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows us… |
CVE-2021-30943 | Medium | 4.3 | 2021-08-24 | An issue in the handling of group membership was resolved with improved logic. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12… |
CVE-2021-37693 | Medium | 5.3 | 2021-08-13 | Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an… |
CVE-2021-37156 | High | 7.5 | 2021-08-05 | Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is f… |
CVE-2021-33322 | High | 7.5 | 2021-08-03 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not i… |
CVE-2021-20431 | Medium | 6.5 | 2021-07-26 | IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive informa… |
CVE-2021-20378 | High | 8.8 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another… |
CVE-2021-26037 | Medium | 5.3 | 2021-07-07 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or th… |
CVE-2021-34428 | Low | 2.9 | 2021-06-22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID i… |
CVE-2021-22221 | Medium | 6.5 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versi… |
CVE-2021-32923 | High | 7.4 | 2021-06-03 | HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their… |
CVE-2020-10709 | High | 7.1 | 2021-05-27 | A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication… |
CVE-2021-22136 | Low | 3.5 | 2021-05-13 | In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being resp… |
CVE-2021-1501 | High | 8.6 | 2021-04-29 | A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2021-31408 | Medium | 6.3 | 2021-04-23 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses… |
CVE-2019-3867 | Medium | 4.1 | 2021-03-18 | A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could… |
CVE-2020-35358 | Critical | 9.8 | 2021-03-15 | DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password a… |
CVE-2009-20001 | High | 8.1 | 2021-03-07 | An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user se… |
CVE-2021-3144 | Critical | 9.1 | 2021-02-27 | In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) |
CVE-2021-27351 | Medium | 5.3 | 2021-02-19 | The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently act… |
CVE-2021-21032 | Medium | 5.6 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of thi… |
CVE-2021-21031 | Medium | 5.6 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could… |
CVE-2021-26921 | Medium | 6.5 | 2021-02-09 | In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled. |
CVE-2020-4995 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from… |
CVE-2020-6649 | Critical | 9.8 | 2021-02-08 | An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user se… |
CVE-2021-3311 | Critical | 9.8 | 2021-02-05 | An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: t… |
CVE-2020-14247 | Medium | 6.5 | 2021-02-04 | HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID. |
CVE-2021-3183 | High | 7.5 | 2021-01-19 | Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login profile. |
CVE-2020-15220 | Medium | 6.1 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a… |
CVE-2020-15218 | Medium | 6.8 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after… |
CVE-2016-20007 | High | 7.5 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory… |
CVE-2020-29667 | Critical | 9.8 | 2020-12-10 | In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control o… |
CVE-2020-4696 | Medium | 4.3 | 2020-11-30 | IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from… |
CVE-2020-13353 | Low | 2.5 | 2020-11-17 | When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. |
CVE-2020-27422 | Critical | 9.8 | 2020-11-16 | In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeove… |
CVE-2020-23140 | High | 8.1 | 2020-11-09 | Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any… |
CVE-2020-23136 | Medium | 5.5 | 2020-11-09 | Microweber v1.1.18 is affected by no session expiry after log-out. |
CVE-2020-15950 | High | 8.8 | 2020-11-05 | Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout. |
CVE-2020-25374 | Low | 2.6 | 2020-10-28 | CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle t… |
CVE-2020-24713 | High | 7.5 | 2020-10-28 | Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. |
CVE-2020-27739 | Critical | 9.8 | 2020-10-28 | A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOT… |
CVE-2020-15269 | High | 7.4 | 2020-10-20 | In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3… |
CVE-2020-1666 | Medium | 6.6 | 2020-10-16 | The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console ca… |
CVE-2020-6363 | Medium | 4.6 | 2020-10-15 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established afte… |
CVE-2020-4395 | Medium | 5.4 | 2020-10-14 | IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the… |
CVE-2020-4780 | Medium | 5.3 | 2020-10-12 | OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of th… |
CVE-2019-19199 | High | 7.4 | 2020-10-02 | REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout. |
CVE-2020-15774 | Medium | 6.8 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle… |
CVE-2020-13307 | Low | 3.8 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication… |
CVE-2020-13305 | Low | 3.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user f… |
CVE-2020-13302 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions an… |
CVE-2020-13299 | High | 8.1 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could r… |
CVE-2020-8234 | Critical | 9.8 | 2020-08-21 | A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling th… |
CVE-2020-5774 | High | 7.1 | 2020-08-21 | Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration… |
CVE-2020-17474 | Critical | 9.8 | 2020-08-14 | A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, elevate us… |
CVE-2020-17473 | Medium | 5.9 | 2020-08-14 | Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by imper… |
CVE-2020-1776 | Low | 3.5 | 2020-07-20 | When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the cas… |
CVE-2020-15074 | High | 7.5 | 2020-07-14 | OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making… |
CVE-2020-6292 | High | 8.8 | 2020-07-14 | Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration. |
CVE-2020-6291 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leadi… |
CVE-2020-6644 | High | 8.1 | 2020-06-22 | An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admi… |
CVE-2017-18905 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. |
CVE-2020-1724 | Medium | 4.3 | 2020-05-11 | A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a prev… |
CVE-2020-12690 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when… |
CVE-2020-3188 | Medium | 5.3 | 2020-05-06 | A vulnerability in how Cisco Firepower Threat Defense (FTD) Software handles session timeouts for management connections could allow an unauthenticated, remote… |
CVE-2020-10876 | High | 7.5 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification cod… |
CVE-2020-9482 | Medium | 6.5 | 2020-04-28 | If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication tok… |
CVE-2016-11058 | High | 7.5 | 2020-04-28 | The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs. |
CVE-2020-1762 | High | 7.0 | 2020-04-27 | An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could… |
CVE-2020-8867 | High | 7.5 | 2020-04-22 | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Au… |
CVE-2020-11795 | High | 7.5 | 2020-04-22 | In JetBrains Space through 2020-04-22, the session timeout period was configured improperly. |
CVE-2020-11688 | High | 7.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session. |
CVE-2019-12001 | Medium | 6.4 | 2020-04-17 | A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SA… |
CVE-2020-4284 | Medium | 5.3 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insuffic… |
CVE-2020-4253 | High | 8.8 | 2020-03-24 | IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-F… |
CVE-2020-6197 | Low | 3.3 | 2020-03-10 | SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local… |
CVE-2014-2595 | Critical | 9.8 | 2020-02-12 | Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained fro… |
CVE-2020-1768 | Medium | 5.4 | 2020-02-07 | The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will… |
CVE-2019-5462 | High | 8.8 | 2020-01-28 | A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed. |
CVE-2019-5647 | Medium | 4.4 | 2020-01-22 | The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This b… |
CVE-2020-0621 | Medium | 4.4 | 2020-01-14 | A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows Security Feature Bypass… |
CVE-2019-10229 | High | 8.8 | 2019-12-31 | An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and au… |
CVE-2019-11106 | Medium | 6.7 | 2019-12-18 | Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 a… |
CVE-2019-8803 | High | 8.4 | 2019-12-18 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watch… |
CVE-2019-12421 | High | 8.8 | 2019-11-19 | When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token… |
CVE-2019-8149 | Critical | 9.8 | 2019-11-06 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated… |
CVE-2016-11014 | Critical | 9.8 | 2019-10-16 | NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case. |
CVE-2019-17375 | High | 8.8 | 2019-10-09 | cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). |
CVE-2019-9269 | High | 7.3 | 2019-09-27 | In System Settings, there is a possible permissions bypass due to a cached Linux user ID. This could lead to a local permissions bypass with no additional exec… |
CVE-2018-21018 | Critical | 9.8 | 2019-09-22 | Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions. |
CVE-2019-5531 | Medium | 5.4 | 2019-09-18 | VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6… |
CVE-2019-14826 | Medium | 4.4 | 2019-09-17 | A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain… |
CVE-2019-16133 | Medium | 6.5 | 2019-09-09 | An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can… |
CVE-2019-5638 | High | 8.7 | 2019-08-21 | Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, lo… |