CVE-2024-56413

Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 Windows before build 39169...

CVE-2024-56413

The CVE-2024-56413 issue affects Acronis Cyber Protect 16 (Windows) prior to build 39169 and is due to missing session invalidation after a user is deleted. This can leave a deleted user’s session active, creating potential access risks. The PT-2025-3276 entry confirms affected versions and recom...

PT-2025-3276 · Acronis · Acronis Cyber Protect 16

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 16 Windows versions before build 39169 Description: The issue is related to missing session invalidation after a user is deleted. This means that even after a user's account is deleted, their session remains active. The...

FreeBSD : kanboard -- Insufficient session invalidation (94b2d58a-c1e9-11ef-aa3f-dcfe074bd614)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 94b2d58a-c1e9-11ef-aa3f-dcfe074bd614 advisory. [email protected] reports: Kanboard is project management software that focuses on the...

kanboard -- Insufficient session invalidation

[email protected] reports: Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler app/Core/Session/SessionHandler.php, to store...

CVE-2024-55603

CVE-2024-55603 affects Kanboard. Affected versions allow sessions to remain valid after expiry because the custom session handler queries the sessions table without properly validating the expires_at lifetime, enabling a login for expired sessions. The SessionHandlerInterface::gc cleanup runs onl...

CVE-2024-55603 Insufficient session invalidation in Kanboard

Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler app/Core/Session/SessionHandler.php, to store the session data in a database...

CVE-2024-55603 Insufficient session invalidation in Kanboard

Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler app/Core/Session/SessionHandler.php, to store the session data in a database...

Session Fixation

org.jenkins-ci.plugins, oic-auth is vulnerable to Session Fixation. The vulnerability is due to the plugin failing to invalidate the previous session on login, allowing an attacker to reuse an old session...

CVE-2024-51727

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a user's account...

CVE-2024-51727

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a user's account...

CVE-2024-51727 Ruijie Reyee OS Premature Release of Resource During Expected Lifetime

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a user's account...

CVE-2024-51727

CVE-2024-51727 affects Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x. The issue is described as a feature that could allow an attacker to invalidate a legitimate user’s session, causing a denial-of-service condition on the user’s account. The connected sources consistently refe...

Ruijie Networks ReyeeOS 安全漏洞

Ruijie Networks ReyeeOS is a router from Ruijie Networks China. A security vulnerability exists in Ruijie Networks ReyeeOS version 2.206.x up to and including 2.320.x. An attacker can exploit this vulnerability to invalidate a legitimate user's session and launch a denial of service attack agains...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

CVE-2024-46892

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing...

CVE-2024-46892

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing...

CVE-2024-46892

CVE-2024-46892 affects Siemens SINEC INS (versions earlier than V1.0 SP2 Update 3). The issue is improper session invalidation: when a user is deleted, disabled, or has permissions changed, the system may allow the attacker’s authenticated session to remain active and perform actions post-change....

PT-2024-8718 · Siemens · Sinec Ins

Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 3 Description: A vulnerability has been identified in the affected application where it does not properly invalidate sessions when the associated user is deleted, disabled, or their permissions are...