CVE-2024-50562

An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session...

Fortinet FortiOS SSL-VPN 代码问题漏洞

Fortinet FortiOS SSL-VPN is a VPN software from Fortinet, Inc. A code issue vulnerability exists in Fortinet FortiOS SSL-VPN version 7.6.0, 7.4.6 and below, 7.2.10 and below, all versions of 7.0, and all versions of 6.4, which stems from an insufficient session expiration, and could allow an...

CVE-2024-45462

The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out...

CVE-2020-23136

Microweber v1.1.18 is affected by no session expiry after log-out...

wire-webapp 安全漏洞

wire-webapp is an open source application from Wire Swiss. A security vulnerability exists in wire-webapp versions prior to 2025-05-20-production.0, which stems from a session not being expired correctly, which could lead to automatic re-logins...

PT-2025-21214 · Palo Alto Networks · Palo Alto Networks Prisma Cloud Compute Edition

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Prisma Cloud Compute Edition affected versions not specified Description: The issue arises because web sessions in the web interface of Palo Alto Networks Prisma Cloud Compute Edition do not expire when users are deleted...

CVE-2025-4528

A weakness has been identified in Dígitro NGC Explorer up to 3.44.15/3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration. The attack can be launched remotely. Upgrading to version 3.48.22 mitigates this issue. It is recommended to upgrade the affecte...

SUSE CVE-2024-58087

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue with session expire...

CVE-2024-55603

Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler app/Core/Session/SessionHandler.php, to store the session data in a database...

InvoicePlane 代码问题漏洞

InvoicePlane is an application from InvoicePlane Open Source. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. A code issue vulnerability exists in InvoicePlane 1.6.1 and prior versions, which stems from the fact that the file /invoices/vi...

SUSE CVE-2024-50286

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbdsmb2sessioncreate There is a race condition between ksmbdsmb2sessioncreate and ksmbdexpiresession. This patch add missing sessionstablelock while adding/deleting session from global session...

SUSE CVE-2024-50086

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add sessionlock when setting SMB2SESSIONEXPIRED and...

IoT Haat Smart Plug IH-IN-16A-S 安全漏洞

IoT Haat Smart Plug IH-IN-16A-S is a smart plug from IoT Haat. A security vulnerability exists in IoT Haat Smart Plug IH-IN-16A-S version v5.16.1, which stems from the presence of a session expiration insufficiency issue and lack of validation of authentication tokens, which could lead to an...

CVE-2024-32006

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 SP2. The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authentication...

OpenVPN Resource Leak

The vulnerability of the OpenVPN software is related to the lack of resource release after the expiration of its duration. Exploiting this vulnerability allows a hacker to “keep the session alive,” even if the server was instructed to disconnect this client...

CVE-2024-27782

Multiple insufficient session expiration weaknesses CWE-613 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests...

Multiple vulnerabilities in NEC Aterm series

Overview Aterm series provided by NEC Corporation contains multiple vulnerabilities listed below. Incorrect Permission Assignment for Critical Resource CWE-732 - CVE-2024-28005 Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 - CVE-2024-28006 Incorrect Permission...

Dell PowerScale OneFS 代码问题漏洞

Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. A code issue vulnerability exists in Dell PowerScale OneFS that stems from the presence of a session expiration vulnerability that can be exploited by an...

CVE-2024-0943

A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attack can be launched remotely. The complexity of an attac...

PT-2024-1361 · Totolink · Totolink N200Re

Name of the Vulnerable Software and Affected Versions: Totolink N200RE V5 version 9.3.5u.6255 B20211224 Description: The issue is related to the /cgi-bin/cstecgi.cgi file in the Totolink N200RE router's firmware, specifically concerning incorrect session expiration. This can allow a remote attack...