Skip to contentCWE-613 vulnerabilities
- reddoxx maildepotREDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not...CVE-2019-191997.4 High
- hashicorp vaultToken leases could outlive their TTL in HashiCorp VaultCVE-2020-25816Fix available6.8 Medium
- gradle enterpriseAn issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. Because of implicitly remembered...CVE-2020-157746.8 Medium
- gitlabA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was...CVE-2020-13307Fix available3.8 Low
- gitlabA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was...CVE-2020-13305Fix available3.5 Low
- gitlabA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under...CVE-2020-13302Fix available3.8 Low
- gitlabA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The...CVE-2020-13299Fix available8.1 High
- ui edgemax firmwareA vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web...CVE-2020-82349.8 Critical
- tenable nessus, tenable, inc. tenable nessus +1 moreNessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted...CVE-2020-57747.1 High
- zkteco zkbiosecurity server, facedepot 7b firmware +1 moreA token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0...CVE-2020-174749.8 Critical
- zkteco zkbiosecurity server, facedepot 7b firmware +1 moreLack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0...CVE-2020-174735.9 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreInvalidating or changing user does not invalidate sessionCVE-2020-1776Fix available3.5 Low
- openvpn access serverOpenVPN Access Server older than version 2.8.4 generates new user authentication tokens instead...CVE-2020-150747.5 High
- sap disclosure managementLogout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the...CVE-2020-62924.6 Medium
- sap disclosure managementSAP Disclosure Management, version 10.1, session mechanism does not have expiration data set...CVE-2020-62915.4 Medium
- fortinet fortideceptorAn insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an...CVE-2020-66448.1 High
- mattermost serverMattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is usedCVE-2017-18906Fix available8.1 High
- mattermost serverMattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service providerCVE-2017-18905Fix available5.3 Medium
- keycloak, redhat openshift application runtimes, single sign-on +2 moreKeycloak Insufficient Session ExpiryCVE-2020-1724Fix available4.3 Medium
- cisco firepower threat defense software, asa 5505 firmware, asa 5510 firmware +11 more +13 moreCisco Firepower Threat Defense Software Management Interface Denial of Service VulnerabilityCVE-2020-31885.3 Medium
- openstack keystoneInsufficient Session Expiration in OpenStack KeystoneCVE-2020-12690Fix available8.8 High
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not...CVE-2020-108767.5 High
- apache nifi registryInsufficient Session Expiration in Apache NiFi RegistryCVE-2020-9482Fix available6.5 Medium
- netgear genieThe NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded...CVE-2016-110587.5 High
- [kiali] kiali, redhat openshift service mesh +1 moreInsufficient Session Expiration in KialiCVE-2020-1762Fix available7.0 High
- opc foundation ua .net standard, opcfoundation unified architecture .net-standard +1 moreInsufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net StandardCVE-2020-8867Fix available5.3 Medium
- jetbrains spaceIn JetBrains Space through 2020-04-22, the session timeout period was configured improperly.CVE-2020-117957.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his...CVE-2020-116887.5 High
- hpe msa 1040 firmware, msa 1050 firmware, msa 2040 firmware +3 more +5 moreA remote session reuse vulnerability leading to access restriction bypass was discovered in HPE...CVE-2019-120016.4 Medium
- ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose...CVE-2020-42845.3 Medium
- ibm content navigatorIBM Content Navigator 3.0CD does not invalidate session after logout which could allow an...CVE-2020-42536.3 Medium
- sap enable nowSAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The...CVE-2020-61973.8 Low
- sap enable nowSAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be...CVE-2020-61785.4 Medium
- barracuda web application firewallBarracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass...CVE-2014-2595Public exploitEPSS 16.9%9.8 Critical
- otrsExternal Interface does not invalidate sessionCVE-2020-17685.4 Medium
- gitlab, gitlab community edition and gitlab enterprise edition +1 moreA privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are...CVE-2019-54628.8 High
- rapid7 appspiderRapid7 AppSpider Chrome Plugin Insufficient Session ExpirationCVE-2019-56474.4 Medium
- microsoft windows, windows 10, windows server +2 more +4 moreA security feature bypass vulnerability exists in Windows 10 when third party filters are called...CVE-2020-06214.4 Medium
- mailstore, mailstore server +1 moreAn issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x...CVE-2019-102298.8 High
- intel converged security management engine firmware, trusted execution engine firmware +1 moreInsufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0...CVE-2019-111066.7 Medium
- apple ios, ipados, macos +4 more +6 moreAn authentication issue was addressed with improved state management. This issue is fixed in iOS...CVE-2019-88038.4 High
- apache nifiApache NiFi user log out issueCVE-2019-12421Fix available8.8 High
- intel baseboard management controller firmwareInsufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an...CVE-2019-111689.1 Critical
- adobe systems incorporated magento 2, magento +1 moreMagento Broken authentication and session managememtCVE-2019-8149Fix available9.8 Critical
- netgear jnr1010 firmwareNETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the...CVE-2016-110149.8 Critical
- cpanelcPanel before 82.0.15 allows API token credentials to persist after an account has been renamed...CVE-2019-173758.8 High
- google androidIn System Settings, there is a possible permissions bypass due to a cached Linux user ID. This...CVE-2019-92697.3 High
- joinmastodon mastodonMastodon before 2.6.3 mishandles timeouts of incompletely established sessions.CVE-2018-210189.8 Critical
- vmware esxi, vcenter server, vsphere esxi +2 moreVMware vSphere ESXi (6.7 prior to ESXi670-201904101-SG, 6.5 prior to ESXi650-201907101-SG, 6.0...CVE-2019-55315.4 Medium
- freeipa, red hat ipa, redhat enterprise linux +2 moreA flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache...CVE-2019-148265.6 Medium
- Show moreLoading…