CVE-2022-46177: Insufficient Session Expiration

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, when a user requests for a password reset link email, then changes their primary email, the old reset email is still valid. When the old...

CVE-2022-22371: Insufficient Session Expiration

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195...

Insufficient Session Expiration

derhansen/fechangepwd uses insecure session management. The vulnerability exists because the updatePassword functions in FrontendUserService.php fails to revoke existing sessions for the current user when the password has been changed, allowing an attacker to bypass the authentication mechanism...

SOUND4 IMPACT/FIRST/PULSE/Eco 2.x Insufficient Session Expiration

SOUND4 IMPACT/FIRST/PULSE/Eco =2.x Insufficient Session Expiration Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: 4.1.102 Summary: The SOUND4 IMPACT introduces an innovative process - mono and stereo parts of the signal are processed...

GHSA-53MM-HX32-6475 TYPO3 vulnerable to Insufficient Session Expiration

An issue was discovered in the fechangepwd aka Change password for frontend users extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed...

TYPO3 vulnerable to Insufficient Session Expiration

An issue was discovered in the fechangepwd aka Change password for frontend users extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed...

CVE-2022-23502 TYPO3 contains Insufficient Session Expiration after Password Reset

TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both...

CVE-2022-23502 TYPO3 contains Insufficient Session Expiration after Password Reset

TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both...

CVE-2022-23502: Insufficient Session Expiration

TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both...

CVE-2022-47406: Insufficient Session Expiration

An issue was discovered in the fechangepwd aka Change password for frontend users extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed...

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration

Summary The SOUND4 IMPACT introduces an innovative process - mono and stereo parts of the signal are processed separately to obtain perfect consistency in terms of both sound and level. Therefore, in moving reception, when the FM receiver switches from stereo to mono and back to stereo, the sound...

TYPO3 Insufficient Session Expiration Vulnerability (TYPO3-CORE-SA-2022-014)

TYPO3 is prone to an insufficient session expiration vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

GHSA-MGJ2-Q8WP-29RR TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset

Problem When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. Solution Update to TYPO3 versions 10.4.33, 11.5.20, 12.1.1...

TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset

Problem When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. Solution Update to TYPO3 versions 10.4.33, 11.5.20, 12.1.1...

TYPO3-EXT-SA-2022-016: Insufficient Session Expiration after Password Change in extension "Change password for frontend users" (fe_change_pwd)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2022-016...

TYPO3-EXT-SA-2022-016: Insufficient Session Expiration after Password Change in extension "Change password for frontend users" (fe_change_pwd)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2022-016...

TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-014...

TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-014...

typo3 -- multiple vulnerabilities

TYPO3 reports: TYPO3-CORE-SA-2022-012: Denial of Service in Page Error Handling. TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login. TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset. TYPO3-CORE-SA-2022-015: Arbitrary Code Execution via Form Framework...

The vulnerability of Websoft HCM’s automation software for HR processes lies in the incorrect expiration time of sessions. This allows attackers to reuse the session credentials to access user information.

The vulnerability of Websoft HCM’s automation software for HR processes is related to incorrect session duration settings. Exploiting this vulnerability allows a malicious actor to repeatedly use session credentials to access user information...