598 matches found
CVE-2025-50490
Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack...
CVE-2025-50485
CVE-2025-50485 : PHPGurukul Online Course Registration v3.1 exposes an improper session invalidation in the /crm/change-password.php component, enabling session hijacking. The vulnerability is confirmed across multiple sources, describing inadequate session expiration/invalidation as the root cau...
CVE-2025-50484
PHPGurukul Small CRM v3.0 is affected by an improper session invalidation in the /crm/change-password.php component, enabling session hijacking. The CVE-2025-50484 description consistently cites this issue across multiple sources. The vulnerability arises from failure to terminate sessions proper...
CVE-2025-50486
CVE-2025-50486 affects PHPGurukul Car Rental Project, version 3.0. The vulnerability is due to improper session invalidation in the /carrental/update-password.php component, enabling session hijacking. Documented impact indicates potential control of a user session with high confidentiality impac...
CVE-2025-25019
IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system...
CVE-2025-33005
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...
PT-2025-23628 · Ibm · Ibm Cloud Pak For Security +1
Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite Software versions 1.10.12.0 through 1.11.2.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue arises because the software does not invalidate a session after a user logs out, potentially...
CVE-2025-33005
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...
CVE-2025-33005
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...
PT-2025-23426 · Ibm · Ibm Planning Analytics
Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local versions 2.0 through 2.1 Description: The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after a logout. Recommendations: For versions 2.0 and...
CVE-2024-21492
All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers w...
CVE-2024-29070
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users...
CVE-2024-28866
GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 inclusive are potentially vulnerable to a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a redirectto query parameter with inadequate validation. Attackers...
CVE-2024-56413
Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 Windows before build 39169...
CVE-2024-51727
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a user's account...
CVE-2024-46892
A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing...
CVE-2023-38018
IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574...
CVE-2023-26288
IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477...