Total
301 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-31050 | 1 Typo3 | 1 Typo3 | 2022-06-23 | 7.2 High |
| TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. | ||||
| CVE-2022-2064 | 1 Xgenecloud | 1 Nocodb | 2022-06-22 | 8.8 High |
| Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. | ||||
| CVE-2020-13353 | 1 Gitlab | 1 Gitaly | 2022-06-13 | 3.2 Low |
| When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. | ||||
| CVE-2022-30277 | 1 Bd | 1 Synapsys | 2022-06-10 | 5.7 Medium |
| BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). | ||||
| CVE-2021-27351 | 1 Telegram | 1 Telegram | 2022-05-23 | 5.3 Medium |
| The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session. | ||||
| CVE-2021-27751 | 1 Hcltechsw | 1 Hcl Commerce | 2022-05-16 | 3.3 Low |
| HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible. | ||||
| CVE-2022-23063 | 1 Shopizer | 1 Shopizer | 2022-05-10 | 8.8 High |
| In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. | ||||
| CVE-2021-3461 | 1 Redhat | 2 Keycloak, Single Sign-on | 2022-04-13 | 7.1 High |
| A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name]. | ||||
| CVE-2022-25590 | 1 Surveyking | 1 Surveyking | 2022-03-31 | 6.5 Medium |
| SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application. | ||||
| CVE-2021-39113 | 1 Atlassian | 4 Data Center, Jira, Jira Data Center and 1 more | 2022-03-30 | 7.5 High |
| Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0. | ||||
| CVE-2022-0991 | 1 Admidio | 1 Admidio | 2022-03-28 | 7.1 High |
| Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. | ||||
| CVE-2022-24743 | 1 Sylius | 1 Sylius | 2022-03-22 | 8.2 High |
| Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory. | ||||
| CVE-2022-24744 | 1 Shopware | 1 Shopware | 2022-03-17 | 3.5 Low |
| Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. | ||||
| CVE-2022-24732 | 1 Maddy Project | 1 Maddy | 2022-03-17 | 8.8 High |
| Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms. | ||||
| CVE-2021-38986 | 1 Ibm | 1 Mq | 2022-03-09 | 5.4 Medium |
| IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942. | ||||
| CVE-2022-24332 | 1 Jetbrains | 1 Teamcity | 2022-03-04 | 5.3 Medium |
| In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. | ||||
| CVE-2022-24341 | 1 Jetbrains | 1 Teamcity | 2022-03-04 | 7.5 High |
| In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. | ||||
| CVE-2022-22113 | 1 Daybydaycrm | 1 Daybyday | 2022-02-25 | 8.8 High |
| In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. | ||||
| CVE-2021-25966 | 1 Orchardcore | 1 Orchard Core | 2022-02-25 | 8.8 High |
| In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. | ||||
| CVE-2021-25992 | 1 If-me | 1 Ifme | 2022-02-22 | 9.8 Critical |
| In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks. | ||||