CVE-2025-56643

CVE-2025-56643 Referência pública para CVE-2025-56643 – Vulnerabilidade de Sessão JWT do Wiki.js 2.5.307 Descrição: O Requarks Wiki.js 2.5.307 não revoga ou invalida corretamente tokens JWT ativos quando um utilizador termina a sessão. Como resultado, tokens emitidos anteriormente permanecem...

CVE-2020-24030

CVE-2020-24030 Descrizione ForLogic Qualiex v1 e v3 ha una scadenza del token debole. Ciò consente l'escalation dei privilegi in remoto senza autenticazione e l'accesso a dati sensibili tramite il riutilizzo del token. Date importanti Annuncio al fornitore: 2020-07-12 Data di divulgazione pubblic...

CVE-2020-29667

CVE-2020-29667 Expiração de Sessão Insuficiente | Valor de Cookie Predefinido Descrição sugerida No Lan ATMService M3 ATM Monitoring System 6.1.0, um atacante remoto capaz de usar um valor de cookie padrão, como PHPSESSID=LANIT-IMANAGER, pode obter controle sobre o sistema e operar o estado atual...

domain-locker

Domain Locker Die zentrale Anlaufstelle für alle deine Domainnamen 🌐domain-locker.com Inhalt Über Screenshot Funktionen Live-Demo Erste Schritte Domain-Locker.com Selbst hosten Entwicklung Projekt einrichten Architektur Mitwirken Danksagungen Lizenz Über Das Ziel von Domain Locker ist es, dir...

DEBIAN-CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2025-63314

CVE-2025-63314 - Gestione non corretta dei token di reimpostazione password in Acora CMS Scoperto da Joby Y Daniel di Crowe India 📌 Panoramica DDSN Interactive cm3 Acora CMS versione 10.7.1 contiene una vulnerabilità di sicurezza nella funzionalità di reimpostazione della password. L'applicazione...

CVE-2020-24030

CVE-2020-24030 Descrizione ForLogic Qualiex v1 e v3 ha una debole scadenza dei token. Ciò consente l'escalation dei privilegi da remoto senza autenticazione e l'accesso a dati sensibili tramite il riutilizzo dei token. Date importanti Annuncio al fornitore: 2020-07-12 Data di divulgazione pubblic...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Apache Tomcat is affected by an insufficient session expiration flaw. If the session ID of an authenticated HTTP session is changed after a WebSocket connection has been established under that session, the WebSocket session is not closed when the HTTP session ends, as required by the Jakarta WebS...

BIT-KEYCLOAK-2024-7318 Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds default. Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passco...

CVE-2026-77130

The TYPO3 extension SYSSY – TYPO3 Monitoring & Security Checks (syssy) fails to properly validate the expiration of a client-supplied JWT token . This allows an attacker who already holds a valid SYSSY project API key to continue authenticating with an expired token , effectively bypassing sessio...

CVE-2026-77130 Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...

fortinet-cve-2024-50562

Vulnerabilidade de Reutilização de Sessão SSL-VPN da Fortinet CVE-2024-50562 Scanner profissional, somente com permissão , que comprova se um FortiGate invalida os cookies de sessão após o logout. Um resultado positivo confirma CVE-2024-50562 — uma falha de Expiração de Sessão Insuficiente CWE-61...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: o CheckToken do JWT nunca revalida o estado da conta Produto: go-shiori/shiori Arquivo: internal/domains/auth.go CWE: CWE-613 — Expiração de sessão insuficiente CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 Alto CNA: Turan Security · registro CVE Descrição A função...

PT-2026-81891

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.43 through 7.0.109...

CVE-2026-75554

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...

CVE-2026-75554

CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...