CWE-613

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSI

A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once owner

IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to imperson

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access

SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited

Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout.

An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpi

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revo

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user

In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.

In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foun

The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session ID

The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its tim

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reu

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoin

Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version

An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a use

The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Regi

A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HP

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker

Microweber v1.1.18 is affected by no session expiry after log-out.

The external frontend system uses numerous background calls to the backend. Each background request is treated as user a

IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information

A vulnerability in how Cisco Firepower Threat Defense (FTD) Software handles session timeouts for management connections

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Managem

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a us

A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password updat

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after

A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to

IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated use

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current use

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not b

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project

SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Exp

CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79

A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized user

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a speci

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to

A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and