CVE-2021-24019

An insufficient session expiration vulnerability CWE- 613 in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

FortiClientEMS - Session cookie does not expire after logout

An insufficient session expiration vulnerability CWE- 613 in FortiClientEMS may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Vulnerabilities fixed in FortiSandbox

Due to a session expiration vulnerability in FortiSandbox allows a malicious party to reuse the non-expired session IDs of an administrator reuse to obtain information about other users. obtain. CVE-2020-29012 Due to a vulnerability in the input validation of the sniffer interface of FortiSandbox...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

Session fixation

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-33982

The vulnerability CVE-2021-33982 affects the Fish | Hunt FL iOS app (version 3.8.0 and earlier). It is described as an insufficient session expiration flaw that enables a remote attacker to reuse, spoof, or steal other users’ and admins’ sessions. Connected sources confirm the issue but do not pr...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...

CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...

Session fixation

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...

CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...

CVE-2020-29012

FortiSandbox (versions 3.2.1 and earlier) is affected by an insufficient session expiration vulnerability. The root issue is that admin session IDs may not expire after logout, potentially enabling an attacker who obtains an unexpired admin session ID to access information about other users on th...

CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...

FortiSandbox - Session ID does not expire after logout

An insufficient session expiration vulnerability CWE-613 in FortiSandbox may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetical attacks...

PT-2021-7937 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions 4.2.0 through 4.2.1 Description: The issue is related to the incorrect session expiration in Redmine, a web application for project and task management. When two-factor authentication is enabled for a user's account, existing...

in janeczku/calibre-web

✍️ Description The app does not expire the user's session after the logout. It is possible to continue using the session even when the user has logged out. 🕵️‍♂️ Proof of Concept 1. Login as a user at /login. 2. Select logout, intercepting and copying the user's cookie. 3. After this logout, send a...

Session Fixation in erudika/scoold

✍️ Description Session Fixation vulnerability found in scoold in which it doesn't expire the sessions after password update. 🕵️‍♂️ Proof of Concept Steps to reproduce: 1. Open the same account in the normal and private tab. 2. Change the password from anyone tab let's say private and then refresh...

Session Fixation in chatwoot/chatwoot

✍️ Description The application is vulnerable to Session Fixation vulnerability even after a user changes its password the old sessions on other devices persist. 🕵️‍♂️ Proof of Concept 1. open chatwoot and login to your account on multiple browsers 2. change the password of the account on one of...

The vulnerability of the SessionListener#sessionDestroyed() method in Eclipse Jetty’s servers allows a hacker to exploit their privileges.

The vulnerability of the SessionListenersessionDestroyed method in Eclipse Jetty-related containers is related to an incorrect session expiration time. Exploiting this vulnerability can allow attackers to increase their privileges...