Skip to contentCWE-613 vulnerabilities
- weaver eteams oaAn issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the...CVE-2019-161336.5 Medium
- rapid7 nexposeRapid7 Nexpose Insufficient Session ManagementCVE-2019-56388.7 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreAuthorization session conflationCVE-2019-2386Fix available7.1 High
- primasystems flexairPrima Systems FlexAir devices have an Insufficient Session-ID Length.CVE-2019-72808.8 High
- siemens ag logo!8, siemens logo\!8 firmware +1 moreA vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 /...CVE-2019-65848.8 High
- pivotal ops manager, pivotal software operations manager +1 moreOps Manager uaa client issues tokens after refresh token expirationCVE-2019-37906.1 Medium
- progress sitefinityProgress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries...CVE-2019-72156.5 Medium
- ibm spectrum control standard edition, spectrum control, tivoli storage productivity center +2 moreIBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2...CVE-2019-40724.7 Medium
- parsecgaming parsecA vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1...CVE-2018-66349.8 Critical
- jenkins, oracle communications cloud native core automated test suite, redhat openshift container platform +2 moreInsufficient Session Expiration in JenkinsCVE-2019-1003049Fix available8.1 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until rebootCVE-2019-00155.4 Medium
- aio-libs aiohttp sessionaiohttp-session creates non-expiring sessionsCVE-2018-1000814Fix available6.5 Medium
- red hat gluster storageTendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens...CVE-2018-1127Fix available4.2 Medium
- ibm openpages grc platformIBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive...CVE-2016-02344.0 Medium
- sap hana extended application servicesXS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS...CVE-2018-24516.6 Medium
- sddm project sddmAn issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the...CVE-2018-14345Fix available7.5 High
- itrack easy, ieasytec itrackeasy +1 moreiTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each requestCVE-2016-65459.8 Critical
- sensiolabs symfony, debian linux +1 moreSymfony DoSCVE-2018-11386Fix available5.9 Medium
- commscope arris tg1682g firmwareOn Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not...CVE-2018-109908.0 High
- schneider electric se micom p540d range with legacy ethernet board, schneider-electric micom p141 firmware, micom p142 firmware +21 more +23 moreA denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded)...CVE-2018-77586.5 Medium
- mcafee network security management (nsm), network security manager +1 moreSB10192 - Network Security Management (NSM) - Exploitation of session variables, resource IDs and other trusted credentials vulnerabilityCVE-2017-39666.4 Medium
- cisco ios xe software, ios xe +1 moreA vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an...CVE-2018-01528.8 High
- philips intellispace cardiovascularPhilips ISCV application prior to version 2.3.0 has an insufficient session expiration...CVE-2018-54386.3 Medium
- cloudfoundry cf-deployment, cf-release, dell emc cloud controller +1 more +3 moreIn Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf...CVE-2018-11958.8 High
- [unknown] cloudformsA flaw was found in the CloudForms account configuration when using VMware. By default, a shared...CVE-2017-12191Fix available7.4 High
- asus asuswrtImproper administrator IP validation after his login in the HTTPd server in all current versions ...CVE-2017-156538.8 High
- ibm integration busIBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to...CVE-2017-16935.6 Medium
- maharaMahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are...CVE-2017-10001366.5 Medium
- maharaMahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are...CVE-2017-10001356.5 Medium
- maharaMahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to...CVE-2017-10001316.5 Medium
- keycloak, redhat single sign on +1 moreKeycloak CSRF VulnerabilityCVE-2017-12159Fix available7.5 High
- cloudfoundry cf-release, pivotal software cloud foundry elastic runtime, cloud foundry uaa +2 moreCloud Foundry Runtime Insufficient Session Expiration vulnerabilityCVE-2015-5171Fix available9.8 Critical
- f5 big-ip access policy manager, big-ip advanced firewall manager, big-ip analytics +8 more +10 moreiControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and...CVE-2017-61457.3 High
- prominent multiflex m10a controller firmwareAn Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller...CVE-2017-140075.6 Medium
- simplesamlphpSimpleSAMLphp Invalid token creation and validationCVE-2017-12867Fix available5.9 Medium
- openprojectOpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote...CVE-2017-116678.1 High
- milwaukee one-keyThe Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one...CVE-2017-32155.3 Medium
- moxa awk-3131a series industrial ieee 802.11a/b/g/n wireless ap/bridge/client, awk-3131a firmware +1 moreAn exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK...CVE-2016-87125.9 Medium
- sierrawireless aleos firmwareSierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are...CVE-2016-50699.8 Critical
- dnatools dnalimsAn issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking...CVE-2017-6529Public exploit8.8 High
- f5 nginx, debian linux +1 morenginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key...CVE-2014-3616Fix available4.3 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Keystone Domain-scoped tokens don't get revokedCVE-2014-5253Fix available4.9 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation eventsCVE-2014-5252Fix available4.9 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Identity (Keystone) Multiple vulnerabilities in revocation eventsCVE-2014-5251Fix available4.9 Medium
- openstack essex, folsom, grizzly +6 more +8 moreOpenstack nova: vnc proxy can connect to the wrong vmCVE-2013-0335Fix available7.6 High