Skip to contentCWE-613 vulnerabilities
- atlassian data center, jira, jira server +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to...CVE-2021-391137.5 High
- northern.tech useradmThe useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in...CVE-2021-353427.5 High
- apple ipados, macos, watchos +1 more +3 moreAn issue in the handling of group membership was resolved with improved logic. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12.1. A malicious user may be able to leave…CVE-2021-309434.3 Medium
- discourseRe-use of email tokens in DiscourseCVE-2021-37693Fix available5.3 Medium
- redmineRedmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor...CVE-2021-37156Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to invalidate password reset tokens after useCVE-2021-33322Fix available7.5 High
- ibm i2 analyst's notebook premium, i2 analysts notebook +1 moreIBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after...CVE-2021-204314.3 Medium
- ibm guardium data encryptionIBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout...CVE-2021-203786.3 Medium
- joomla! project cms, joomla joomla\! +1 more[20210703] - Core - Lack of enforced session terminationCVE-2021-260375.3 Medium
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +14 more +16 moreSessionListener can prevent a session from being invalidated breaking logoutCVE-2021-34428Public exploitFix available2.9 Low
- cisco small business 220 series smart plus switches, sf220-24 firmware, sf220-24p firmware +7 more +9 moreCisco Small Business 220 Series Smart Switches VulnerabilitiesCVE-2021-15427.2 High
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5...CVE-2021-22221Fix available6.5 Medium
- hashicorp vaultInvalid session token expirationCVE-2021-32923Fix available7.4 High
- red hat tower, redhat ansible tower +1 moreA security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2...CVE-2020-107097.1 High
- elastic kibanaIn Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where...CVE-2021-221363.5 Low
- cisco adaptive security appliance software, adaptive security appliance (asa) software, secure firewall threat defense +2 moreCisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software SIP Denial of Service VulnerabilityCVE-2021-15018.6 High
- vaadin flow, flow-client, vaadin +2 moreServer session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19CVE-2021-31408Fix available6.3 Medium
- project quay quayA vulnerability was found in the Quay web application. Sessions in the Quay web application never...CVE-2019-38674.1 Medium
- domainmodDomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On...CVE-2020-353589.8 Critical
- runzero platform, shopware +1 morePotential Session Hijacking in ShopwareCVE-2021-32710Fix available5.9 Medium
- mantisbtMantisBT Insufficient Session Expiration cookie string not reset after logoutCVE-2009-20001Fix available8.1 High
- saltstack salt, debian linux, fedoraproject fedora +2 moreSaltStack Salt eauth tokens can be used once after expirationCVE-2021-3144Fix available9.1 Critical
- telegramThe Terminate Session feature in the Telegram application through 7.2.1 for Android, and through...CVE-2021-27351Fix available5.3 Medium
- adobe magento commerce, magento +1 moreMagento Commerce Failure To Invalidate User Session Could Lead To Unauthorized AccessCVE-2021-21032Fix available5.6 Medium
- magento, adobe magento.com +1 moreMagento Commerce Failure To Invalidate User Session Could Lead To Unauthorized AccessCVE-2021-21031Fix available5.6 Medium
- ibm security identity governance and intelligenceIBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout...CVE-2020-49954.0 Medium
- argoproj argo cdIn util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.CVE-2021-26921Fix available6.5 Medium
- fortinet fortiisolatorAn insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and...CVE-2020-66499.8 Critical
- octobercms octoberOctober CMS Session ID not invalidated after logoutCVE-2021-3311Fix available9.8 Critical
- hcltechsw onetest performanceHCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could...CVE-2020-142476.5 Medium
- files fat clientFiles.com Fat Client 3.3.6 allows authentication bypass because the client continues to have...CVE-2021-31837.5 High
- combodo itopSession fixationCVE-2020-152206.1 Medium
- combodo itopAdmin pages are cached and can be embeddedCVE-2020-152186.8 Medium
- rest\/json project rest\/jsonThe REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033....CVE-2016-200077.5 High
- lanatmservice m3 atm monitoring systemIn Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie...CVE-2020-29667Public exploit9.8 Critical
- ibm cloud pak for securityIBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could...CVE-2020-46965.3 Medium
- gitlab gitalyGitaly Insufficient Session Expiration vulnerabilityCVE-2020-13353Fix available2.5 Low
- anuko time trackerIn Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire...CVE-2020-27422Public exploit9.8 Critical
- microweberMicroweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both...CVE-2020-231408.1 High
- microweberMicroweber Insufficient Session ExpiryCVE-2020-231365.5 Medium
- immutaImmuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout.CVE-2020-159508.8 High
- cyberark privileged session managerCyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal...CVE-2020-253742.6 Low
- getgophish gophishGophish through 0.10.1 does not invalidate the gophish cookie upon logout.CVE-2020-247137.5 High
- citadel webcitA Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated...CVE-2020-277399.8 Critical
- sparksolutions spreeExpired token reuse in SpreeCVE-2020-15269Fix available7.4 High
- yubico yubihsm-shell, fedoraproject fedora +1 moreAn issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The...CVE-2020-243877.5 High
- juniper junos os evolvedJunos OS Evolved: 'console log-out-on-disconnect' fails to terminate session on console cable disconnectionCVE-2020-16666.6 Medium
- sap commerce cloudSAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that...CVE-2020-63634.6 Medium
- ibm security access manager applianceIBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could...CVE-2020-43956.3 Medium
- ibm curam social program management, curam spm +1 moreOOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam...CVE-2020-47804.3 Medium
- Show moreLoading…