PT-2022-9842

Name of the Vulnerable Software and Affected Versions HCL Commerce affected versions not specified Description The issue is related to an Insufficient Session Expiration, where parts of the application remain accessible after the session has expired, under certain circumstances. Recommendations A...

CVE-2022-23063

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

Session fixation

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

CVE-2022-23063

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

CVE-2022-23063 Shopizer - Insufficient Session Expiration

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

CVE-2022-23063 Shopizer - Insufficient Session Expiration

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

CVE-2022-23063

CVE-2022-23063 affects Shopizer versions 2.3.0 to 3.0.1. The vulnerability is described as insufficient session expiration: when a password is changed by a user or an administrator, a user who is already logged in continues to have access to the application after the password change. The provided...

CVE-2022-23063: Insufficient Session Expiration

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

PT-2022-15823

Name of the Vulnerable Software and Affected Versions Shopizer versions 2.3.0 through 3.0.1 Description The issue is related to insufficient session expiration. When a user's password is changed by themselves or an administrator, a user who was already logged in will still have access to the...

Shopizer 代码问题漏洞

Shopizer is a Java-based open source e-commerce solution from the Shopizer team. A code issue vulnerability exists in Shopizer versions 2.3.0 through 3.0.1 that is prone to insufficient session expiration. When a password is changed by a user or administrator, a logged-in user can still access th...

CVE-2022-23063

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

Insufficient Session Expiration

389 Directory Server is vulnerable to insufficient session expiration. The vulnerability exists because it allows expired passwords to access the database to cause improper authentication which allows an attacker to perform unauthorized actions...

Shopify: Disconnecting an external login provider does not revoke session

Hi team, Summary: attacker could create a backdoor using google login function.if an attacker stole the login password of victims throught any means. attacker could connect his/her google account and create a backdoor and attacker login with google if the victim disconnect attacker session did no...

GHSA-JM72-67RM-763J MantisBT Insufficient Session Expiration cookie string not reset after logout

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...

MantisBT Insufficient Session Expiration cookie string not reset after logout

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...

CVE-2021-27751

HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible...

Keycloak insufficient session expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

GHSA-CM29-6WX7-P874 Keycloak insufficient session expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

CVE-2021-3461: Insufficient Session Expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

CVE-2022-25590: Insufficient Session Expiration

SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application...