Shopify: Disconnecting an external login provider does not revoke session

Hi team, Summary: attacker could create a backdoor using google login function.if an attacker stole the login password of victims throught any means. attacker could connect his/her google account and create a backdoor and attacker login with google if the victim disconnect attacker session did no...

MantisBT Insufficient Session Expiration cookie string not reset after logout

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...

GHSA-JM72-67RM-763J MantisBT Insufficient Session Expiration cookie string not reset after logout

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...

CVE-2021-27751

HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible...

Keycloak insufficient session expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

GHSA-CM29-6WX7-P874 Keycloak insufficient session expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

Insufficient Session Expiration

admidio/admidio is vulnerable to insecure session management. The vulnerability exists due to insufficient sanitization in session expiration in the refreshAutoLogin function in the Session.php file leading to user account compromise...

GHSA-MF79-F657-47WW Insufficient Session Expiration in Admidio

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account...

Insufficient Session Expiration in Admidio

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account...

CVE-2022-0991

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9...

CVE-2022-0991

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9...

Session fixation

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9...

CVE-2022-0991 Insufficient Session Expiration in admidio/admidio

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9...

CVE-2022-0991

CVE-2022-0991 affects admidio/admidio prior to 4.1.9 due to insufficient session expiration. The root cause is that changing a password in one session may not terminate other active sessions, potentially allowing continued access. Documented impact includes risk to account security; mitigation is...

CVE-2022-0991 Insufficient Session Expiration in admidio/admidio

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9...

Admidio 代码问题漏洞

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums, and downloads. A security vulnerability exists in Admidio before 4.1.9, which stems from insufficient session expiration...

GHSA-MF3V-F2QQ-PF9G Insufficient Session Expiration in Sylius

Impact The reset password token was not set to null after the password was changed. This is causing behaviour in which the same token can be used several times, so it can result in a leak of the existing token and an unauthorised password change. Patches The issue is fixed in versions: 1.10.11,...

Insufficient Session Expiration in Sylius

Impact The reset password token was not set to null after the password was changed. This is causing behaviour in which the same token can be used several times, so it can result in a leak of the existing token and an unauthorised password change. Patches The issue is fixed in versions: 1.10.11,...

CVE-2022-24743 Insufficient Session Expiration in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2022-24744 Insufficient Session Expiration in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...