Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

CVEs (684)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-11795 1Jetbrains 1Space Jun 17, 2026 Apr 22, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.
CVE-2020-11688 1Jetbrains 1Teamcity Jun 17, 2026 Apr 22, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.
CVE-2019-12001 1Hpe 6Msa 1040 Firmware Msa 1050 FirmwareMsa 2040 Firmware+3 more Jun 17, 2026 Apr 17, 2020 N/A· v4 6.4 MEDIUM· v3 7.1 HIGH· v2 A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage...Show more A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage version(s): GL225P001 and earlier; GL225P001 and earlier; VE270R001-01 and earlier; GL225P001 and earlier; VL270R001-01 and earlier; VL270R001-01 and earlier.Show less
CVE-2020-4284 1Ibm 1Security Information Queue Jun 17, 2026 Apr 8, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176...Show more IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176207.Show less
CVE-2020-4253 1Ibm 1Content Navigator Jun 17, 2026 Mar 24, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 175559.
CVE-2020-6197 1Sap 1Enable Now Jun 17, 2026 Mar 10, 2020 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local access, for instance, to still download the portables.
CVE-2014-2595 1Barracuda 1Web Application Firewall Nov 21, 2024 Feb 12, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
CVE-2020-1768 1Otrs 1Otrs Jun 17, 2026 Feb 7, 2020 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14...Show more The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions.Show less
CVE-2019-5462 1Gitlab 1Gitlab Jun 17, 2026 Jan 28, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.
CVE-2019-5647 1Rapid7 1Appspider Jun 17, 2026 Jan 22, 2020 N/A· v4 7.1 HIGH· v3 3.6 LOW· v2 The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier,...Show more The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.Show less
CVE-2020-0621 1Microsoft 3Windows 10 Windows Server 2016Windows Server 2019 Jun 17, 2026 Jan 14, 2020 N/A· v4 4.4 MEDIUM· v3 2.1 LOW· v2 A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows Security Feature Bypass Vulnerability'.
CVE-2019-10229 1Mailstore 2Mailstore Mailstore Server Jun 17, 2026 Dec 31, 2019 N/A· v4 8.8 HIGH· v3 6.0 MEDIUM· v2 An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is ab...Show more An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password on the second login attempt.Show less
CVE-2019-11106 1Intel 2Converged Security Management Engine Firmware Trusted Execution Engine Firmware Jun 17, 2026 Dec 18, 2019 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable e...Show more Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access.Show less
CVE-2019-8803 1Apple 5Ipados Iphone OsMac Os X+2 more Jun 17, 2026 Dec 18, 2019 N/A· v4 8.4 HIGH· v3 4.6 MEDIUM· v2 An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A local attacker may be able to login to the account...Show more An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A local attacker may be able to login to the account of a previously logged in user without valid credentials..Show less
CVE-2019-12421 1Apache 1Nifi Jun 17, 2026 Nov 19, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits t...Show more When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.Show less
CVE-2019-8149 1Magento 1Magento Jun 17, 2026 Nov 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalid...Show more Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication.Show less
CVE-2016-11014 1Netgear 1Jnr1010 Firmware Nov 21, 2024 Oct 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.
CVE-2019-17375 1Cpanel 1Cpanel Jun 17, 2026 Oct 9, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
CVE-2019-9269 1Google 1Android Jun 17, 2026 Sep 27, 2019 N/A· v4 7.3 HIGH· v3 4.4 MEDIUM· v2 In System Settings, there is a possible permissions bypass due to a cached Linux user ID. This could lead to a local permissions bypass with no additional execution privileges needed. User interaction is needed for explo...Show more In System Settings, there is a possible permissions bypass due to a cached Linux user ID. This could lead to a local permissions bypass with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-36899497Show less
CVE-2018-21018 1Joinmastodon 1Mastodon Nov 21, 2024 Sep 22, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

Previous 1...313233 34 35 Next