CWE-613

Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by br

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiF

An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the dire

Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a se

An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, m

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would rem

In System Settings, there is a possible permissions bypass due to a cached Linux user ID. This could lead to a local per

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's

Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwor

IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to rema

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11,

A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections

VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-2018

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attack

Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST para

Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) o

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 28

A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote a

On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state

An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for us

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that ha

XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced

A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet b

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and

Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAf

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker c

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x befor

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users se

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Ses

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous us

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Fo

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID pa

An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP runni

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use

iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable as logged-in

Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessi

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret

An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's

The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, i