CVE-2020-35358

DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access t...

CVE-2020-35358

CVE-2020-35358 affects DomainMOD domainmod-v4.15.0 and is caused by an insufficient session expiration mechanism: after a password change, sessions authenticated with the new password and those using the old password remain active in other browsers/devices. Documents describe multiple reports (RH...

Domainmod 代码问题漏洞

Domainmod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets from the Domainmod community. A security vulnerability exists in DomainMOD domainmod-v4.15.0, which stems from an insufficient session expiration vulnerability. An...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

CVE-2020-6649 affects FortiIsolator 2.0.1 and earlier. Insufficient session expiration could let an attacker reuse unexpired admin session IDs to gain admin privileges if the session ID is obtained (as noted in Fortinet advisory FG-IR-20-011). Affected version lineage: FortiIsolator 2.0.1 and bel...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Session ID does not expire after logout in FortiIsolator

An insufficient session expiration vulnerability in FortiIsolator may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-29667

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration...

Session fixation

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration...

CVE-2020-29667

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration...

CVE-2020-29667

The CVE-2020-29667 entry affects Lan ATMService M3 ATM Monitoring System 6.1.0. Reported weakness: Insufficient session expiration enabled by using a default cookie value (e.g., PHPSESSID=LANIT-IMANAGER), which an unauthenticated remote attacker can exploit to gain control over the system. Connec...

Microweber Session Expires Improperly Vulnerability

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber. An attacker can exploit the vulnerability...

CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

CVE-2020-23140

CVE-2020-23140 affects Microweber 1.1.18 with insufficient session expiration. According to the connected documents, when a user changes password (and email), the existing sessions on other browsers/devices do not expire and remain active, enabling potential reuse of valid sessions across devices...

CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

CVE-2020-15270 Improper session expiration in Parse Server

Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...