Skip to contentCWE-613 vulnerabilities
- answer, answerdev answerdev/answer +1 moreInsufficient Session Expiration in answerdev/answerCVE-2023-1543Fix available6.8 Medium
- ibm robotic process automation, robotic process automation as a service +1 moreIBM Robotic Process Automation session fixationCVE-2023-225913.9 Low
- rami pretixInsufficient Session Expiration in pretixCVE-2023-27891Fix available7.5 High
- vantage6Refresh tokens do not expire in Vantage6CVE-2023-23929Fix available8.8 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central +2 moreInsufficient Session Expiration in ArubaOS Command Line InterfaceCVE-2023-227716.8 Medium
- checkmkInsecure Termination of RestAPI Session TokensCVE-2022-483175.6 Medium
- datahubFailure to Invalidate Session on Logout in DataHubCVE-2023-255626.9 Medium
- dell supportassist, supportassist for home pcs +1 moreSupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration...CVE-2022-343925.5 Medium
- sensiolabs symfonySymfony vulnerable to Session Fixation of CSRF tokensCVE-2022-24895Fix available6.3 Medium
- lemonldap-ng lemonldap\In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be...CVE-2022-37186Fix available5.9 Medium
- pi-hole adminlte, web interface +1 moreImproper session handling of "Remember me for 7 days" functionalityCVE-2023-236148.8 High
- jenkins azure ad, jenkins project azure ad plugin +1 moreInsufficient Session Expiration in Jenkins Azure AD PluginCVE-2023-244268.8 High
- runzero platform, shopware +1 moreInsufficient Session Expiration in Administration in shopwareCVE-2023-22732Fix available3.7 Low
- pyload, pyload pyload/pyload +1 moreInsufficient Session Expiration in pyload/pyloadCVE-2023-0227Fix available8.3 High
- zitadelRefreshToken invalidation vulnerabilityCVE-2023-22492Fix available5.9 Medium
- discourseDiscourse password reset link can lead to in account takeover if user changes to a new emailCVE-2022-46177Fix available5.7 Medium
- ibm robotic process automation for cloud pakIBM Robotic Process Automation for Cloud Pak session fixationCVE-2022-438448.8 High
- ibm sterling b2b integrator standard edition, sterling b2b integrator +1 moreIBM Sterling B2B Integrator Standard Edition session fixationCVE-2022-223715.5 Medium
- change password for frontend users project password for frontend usersTYPO3 vulnerable to Insufficient Session ExpirationCVE-2022-47406Fix available5.4 Medium
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +9 more +11 moreKeycloak: session takeover with oidc offline refreshtokensCVE-2022-3916Fix available6.8 Medium
- typo3TYPO3 contains Insufficient Session Expiration after Password ResetCVE-2022-23502Fix available5.4 Medium
- ibm datapower gatewayIBM DataPower Gateway session fixationCVE-2022-402283.7 Low
- fusiondirectoryFusiondirectory 1.3 suffers from Improper Session Handling.CVE-2022-36179Fix available9.8 Critical
- librenms, librenms librenms/librenms +1 moreInsufficient Session Expiration in librenms/librenmsCVE-2022-4070Fix available2.7 Low
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreInsufficient Session Expiration in ikus060/rdiffwebCVE-2022-3362Fix available6.1 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedCVE-2022-3867Fix available2.7 Low
- ibm mq appliance"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout...CVE-2022-402306.5 Medium
- glpi-project glpiuser session persists even after permanently deleting account in GLPICVE-2022-392344.7 Medium
- octopus serverIn affected versions of Octopus Server it is possible for a session token to be valid...CVE-2022-27829.1 Critical
- lanner inc iac-ast2500a, lannerinc iac-ast2500a firmware +1 moreSession Fixation and Insufficient Session ExpirationCVE-2021-462795.8 Medium
- devhubapp devhubdevhub 0.102.0 was discovered to contain a broken session control.CVE-2022-415425.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow...CVE-2022-412916.3 Medium
- apache airflowSession still functional after user is deactivatedCVE-2022-41672Fix available8.1 High
- octopus serverIn affected versions of Octopus Server it was identified that a session cookie could be used as...CVE-2022-27835.3 Medium
- rapid7 insightvmRapid7 InsightVM Information Disclosure after LogoutCVE-2019-56413.3 Low
- octoprint, octoprint octoprint/octoprint +1 moreInsufficient Session Expiration in octoprint/octoprintCVE-2022-2888Fix available4.4 Medium
- isc bind, fedoraproject fedora, isc bind9 +2 moreBIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedlyCVE-2022-3080Fix available7.5 High
- vmware pinnipedPinniped Supervisor Insufficient Session Expiration vulnerabilityCVE-2022-31677Fix available5.4 Medium
- mealieMealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to...CVE-2022-346245.9 Medium
- namelessmc nameless, namelessmc/nameless +1 moreSession Fixation in namelessmc/namelessCVE-2022-28207.0 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreInsufficient Session Expiration in cockpit-hq/cockpitCVE-2022-2713Fix available8.6 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +10 more +12 moreiControl REST vulnerability CVE-2022-35728CVE-2022-357288.1 High
- nlnet labs unbound, fedoraproject fedora +1 moreNovel "ghost domain names" attack by updating almost expired delegation informationCVE-2022-30699Fix available6.5 Medium
- nlnet labs unbound, fedoraproject fedora +1 moreNovel "ghost domain names" attack by introducing subdomain delegationsCVE-2022-30698Fix available6.5 Medium
- flyte flyteadminInsufficient AccessToken Expiration Check in FlyteAdminCVE-2022-31145Fix available6.5 Medium
- siemens simatic mv540 h, simatic mv540 s, simatic mv550 h +9 more +11 moreA vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S ...CVE-2022-331378.0 High
- heroiclabs heroiclabs/nakama, nakama +1 moreInsufficient Session Expiration in heroiclabs/nakamaCVE-2022-23068.2 High
- ibm curam social program managementIBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout...CVE-2022-223185.9 Medium
- ibm curam social program managementIBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout...CVE-2022-223175.9 Medium
- typo3Insufficient Session Expiration in TYPO3 Admin ToolCVE-2022-31050Fix available6.0 Medium
- Show moreLoading…