Filtered by CWE-613
Filtered by vendor Subscriptions
Total 530 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-0350 1 Engineers Online Portal Project 1 Engineers Online Portal 2025-06-03 3.1 Low
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-250118 is the identifier assigned to this vulnerability.
CVE-2024-21722 1 Joomla 1 Joomla\! 2025-06-02 6.3 Medium
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
CVE-2019-5641 1 Rapid7 1 Insightvm 2025-05-29 3.3 Low
Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visited by previous user
CVE-2022-2888 1 Octoprint 1 Octoprint 2025-05-28 4.4 Medium
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
CVE-2025-22386 1 Optimizely 1 Configured Commerce 2025-05-20 7.3 High
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.
CVE-2021-33322 1 Liferay 2 Digital Experience Platform, Liferay Portal 2025-05-13 7.5 High
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
CVE-2022-41542 1 Devhubapp 1 Devhub 2025-05-13 5.4 Medium
devhub 0.102.0 was discovered to contain a broken session control.
CVE-2022-2782 1 Octopus 1 Octopus Server 2025-05-07 9.1 Critical
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
CVE-2024-52553 1 Jenkins 2 Openid, Openid Connect Authentication 2025-05-07 8.8 High
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.
CVE-2021-46279 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2025-05-07 5.8 Medium
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2022-40230 1 Ibm 1 Mq Appliance 2025-05-03 6.5 Medium
"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532."
CVE-2022-3867 1 Hashicorp 1 Nomad 2025-05-01 2.7 Low
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.
CVE-2022-3362 1 Ikus-soft 1 Rdiffweb 2025-04-30 9.8 Critical
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
CVE-2021-25966 1 Orchardcore 1 Orchard Core 2025-04-30 8.8 High
In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
CVE-2021-25970 1 Tuzitio 1 Camaleon Cms 2025-04-30 8.8 High
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
CVE-2021-25979 1 Apostrophecms 1 Apostrophecms 2025-04-30 9.8 Critical
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
CVE-2021-25940 1 Arangodb 1 Arangodb 2025-04-30 8.8 High
In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.
CVE-2021-25985 1 Darwin 1 Factor 2025-04-30 7.8 High
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.
CVE-2022-36179 1 Fusiondirectory 1 Fusiondirectory 2025-04-29 9.8 Critical
Fusiondirectory 1.3 suffers from Improper Session Handling.
CVE-2022-40228 1 Ibm 1 Datapower Gateway 2025-04-25 3.7 Low
IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.