Filtered by CWE-613
Filtered by vendor Subscriptions
Total 373 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-34428 5 Debian, Eclipse, Netapp and 2 more 21 Debian Linux, Jetty, Active Iq Unified Manager and 18 more 2024-11-21 2.9 Low
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
CVE-2021-33982 1 Myfwc 1 Fish \| Hunt Fl 2024-11-21 7.5 High
An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.
CVE-2021-33322 1 Liferay 2 Dxp, Liferay Portal 2024-11-21 7.5 High
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
CVE-2021-32923 1 Hashicorp 1 Vault 2024-11-21 7.4 High
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
CVE-2021-31408 1 Vaadin 2 Flow, Vaadin 2024-11-21 6.3 Medium
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.
CVE-2021-30943 1 Apple 4 Ipados, Iphone Os, Macos and 1 more 2024-11-21 4.3 Medium
An issue in the handling of group membership was resolved with improved logic. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12.1. A malicious user may be able to leave a messages group but continue to receive messages in that group.
CVE-2021-29868 1 Ibm 1 I2 Ibase 2024-11-21 5.5 Medium
IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213.
CVE-2021-29846 1 Ibm 1 Security Guardium Insights 2024-11-21 2.7 Low
IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 205256.
CVE-2021-27751 1 Hcltechsw 1 Hcl Commerce 2024-11-21 4.4 Medium
HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.
CVE-2021-27351 1 Telegram 1 Telegram 2024-11-21 5.3 Medium
The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session.
CVE-2021-26921 1 Argoproj 1 Argo Cd 2024-11-21 6.5 Medium
In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.
CVE-2021-26037 1 Joomla 1 Joomla\! 2024-11-21 5.3 Medium
An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.
CVE-2021-25992 1 If-me 1 Ifme 2024-11-21 9.8 Critical
In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.
CVE-2021-25985 1 Darwin 1 Factor 2024-11-21 7.8 High
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.
CVE-2021-25981 1 Talkyard 1 Talkyard 2024-11-21 9.8 Critical
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)
CVE-2021-25979 1 Apostrophecms 1 Apostrophecms 2024-11-21 9.8 Critical
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
CVE-2021-25970 1 Tuzitio 1 Camaleon Cms 2024-11-21 8.8 High
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
CVE-2021-25966 1 Orchardcore 1 Orchard Core 2024-11-21 8.8 High
In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
CVE-2021-25940 1 Arangodb 1 Arangodb 2024-11-21 8.8 High
In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.
CVE-2021-24019 1 Fortinet 1 Forticlient Endpoint Management Server 2024-11-21 8.1 High
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)