Visma Public: Session replay vulnerability in app.workbox.dk domain

The researcher found that sessions don't expire when users logs out of their account. This means that if the session cookie and it's value is known, an attacker can impersonate the owner of the account...

CVE-2020-1768: Insufficient Session Expiration

The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions...

CVE-2019-5462: Insufficient Session Expiration

A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed...

CVE-2019-5647 Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue...

CVE-2019-5647: Insufficient Session Expiration

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue...

CVE-2019-10229: Insufficient Session Expiration

An issue was discovered in MailStore Server and Service Provider Edition 9.x through 11.x before 11.2.2. When the directory service for synchronizing and authenticating users is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password on the second login...

CVE-2019-8803: Insufficient Session Expiration

An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A local attacker may be able to login to the account of a previously logged in user without valid credentials...

CVE-2019-11106: Insufficient Session Expiration

Insufficient session validation in the subsystem for IntelR CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; IntelR TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access...

The vulnerability of the HttpFoundation component in the Symfony software development and web application management platform allows attackers to induce a service failure.

The vulnerability of the HttpFoundation component in the Symfony software development and web application management platform is related to an incorrect session expiration time. Exploiting this vulnerability allows a malicious actor to cause service failures...

CVE-2019-12421: Insufficient Session Expiration

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out t...

Stripo Inc: OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGE

OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGE Description: On changing password both session using which user changes password and old sessions in any other browser or device does not expire and remains active. STEPS TO REPRODUCE: 1. Log in to Browser A and make sure to check 'stay logged in ...

CVE-2019-8149: Insufficient Session Expiration

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication...

CVE-2016-11014: Insufficient Session Expiration

NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case...

CVE-2019-17375: Insufficient Session Expiration

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated SEC-517...

VMware vCenter Server 6.0 / 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0013)

The version of VMware vCenter Server installed on the remote host is 6.0 prior to U3j, 6.5 prior to U3, or 6.7 prior to U3, and is, therefore, affected by the following vulnerabilities: - An information disclosure vulnerability caused by insufficient session expiration. This allows an attacker wi...

ESXi 6.0 / 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0013)

The remote VMware ESXi host is version 6.0, 6.5 or 6.7 and is affected the following vulnerabilities: - A remote code execution vulnerability caused by a failure to sanitize filenames in the tab autocomplete feature of BusyBox. This allows an attacker to execute arbitrary code, write arbitrary...

CVE-2018-21018: Insufficient Session Expiration

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions...

CVE-2019-5531

VMware vSphere ESXi 6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG and VMware vCenter Server 6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j contain an information disclosure vulnerability in clients arising from...

CVE-2019-5531

VMware vSphere ESXi 6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG and VMware vCenter Server 6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j contain an information disclosure vulnerability in clients arising from...

Information disclosure

VMware vSphere ESXi 6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG and VMware vCenter Server 6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j contain an information disclosure vulnerability in clients arising from...