CWE-613 · Insufficient Session Expiration (page 7)
Page 7 of 7 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-2386 | High | 7.1 | 2019-08-06 | After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflate… |
CVE-2019-7280 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote att… |
CVE-2019-6584 | High | 8.8 | 2019-06-12 | A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy… |
CVE-2019-3790 | Medium | 6.1 | 2019-06-06 | The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, con… |
CVE-2019-7215 | Medium | 6.5 | 2019-06-06 | Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid o… |
CVE-2019-4072 | Medium | 6.3 | 2019-05-09 | IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even whe… |
CVE-2018-6634 | Critical | 9.8 | 2019-05-07 | A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized users to maintain access to an account. |
CVE-2019-1003049 | High | 8.1 | 2019-04-10 | Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and… |
CVE-2019-0015 | Medium | 5.4 | 2019-01-15 | A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted… |
CVE-2018-1000814 | Medium | 6.5 | 2018-12-20 | aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in No… |
CVE-2018-1127 | Medium | 4.2 | 2018-09-11 | Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few min… |
CVE-2016-0234 | Medium | 4.0 | 2018-08-30 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neg… |
CVE-2018-2451 | Medium | 6.6 | 2018-08-14 | XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolon… |
CVE-2018-14345 | High | 7.5 | 2018-07-17 | An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. A… |
CVE-2016-6545 | Critical | 9.8 | 2018-07-13 | Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded… |
CVE-2018-11386 | Medium | 5.9 | 2018-06-13 | An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0… |
CVE-2018-10990 | High | 8.0 | 2018-05-14 | On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity o… |
CVE-2018-7758 | Medium | 6.5 | 2018-04-18 | A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, MiCOM P540D Range with Legacy Eth… |
CVE-2017-3966 | Medium | 6.4 | 2018-04-04 | Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) be… |
CVE-2018-0152 | High | 8.8 | 2018-03-28 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on… |
CVE-2018-5438 | Medium | 6.3 | 2018-03-20 | Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously… |
CVE-2018-1195 | High | 8.8 | 2018-03-19 | In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tok… |
CVE-2017-12191 | High | 7.4 | 2018-02-28 | A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Rem… |
CVE-2017-15653 | High | 8.8 | 2018-01-31 | Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized u… |
CVE-2017-1693 | Medium | 5.6 | 2018-01-19 | IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before t… |
CVE-2017-1000136 | Medium | 6.5 | 2017-11-03 | Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a passw… |
CVE-2017-1000135 | Medium | 6.5 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable as logged-in users can stay logged in after the ins… |
CVE-2017-1000131 | Medium | 6.5 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they… |
CVE-2017-12159 | High | 7.5 | 2017-10-26 | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenti… |
CVE-2015-5171 | Critical | 9.8 | 2017-10-24 | The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7… |
CVE-2017-6145 | High | 7.3 | 2017-10-20 | iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to co… |
CVE-2017-14007 | Medium | 5.6 | 2017-10-17 | An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's session is available for an extended p… |
CVE-2017-12867 | Medium | 5.9 | 2017-08-29 | The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by… |
CVE-2017-11667 | High | 8.1 | 2017-07-26 | OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a h… |
CVE-2017-3215 | Medium | 5.3 | 2017-06-20 | The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a user_id can be use… |
CVE-2016-8712 | High | 8.1 | 2017-04-13 | An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. The device uses one no… |
CVE-2016-5069 | Critical | 9.8 | 2017-04-10 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL. |
CVE-2017-6529 | High | 8.8 | 2017-03-09 | An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter. |
CVE-2014-3616 | | 2014-12-08 | nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an u… | |
CVE-2013-0335 | High | 7.6 | 2013-03-22 | OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances b… |