CWE-613 · Authentication
652CVEs
0exploited
0with a public check
2likely (EPSS 10%+)
SortMost likely exploited
652 CVEs with CWE-613 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2014-2595Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.Barracuda · Web Application Firewall · 2020-02-12 | – | 17% | 2020-02-12 |
| CVE-2023-30403An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting to the web app afte…Aigital · Wireless-N Repeater Mini Router Firmware · CVSS 7.5 · 2023-05-02 | 7.5 | 15% | 2023-05-02 |
| CVE-2020-27422In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.Anuko · Time Tracker · 2020-11-16 | – | 7.9% | 2020-11-16 |
| CVE-2014-3616nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, wh…F5 · Nginx · 2014-12-08 | – | 5.7% | 2014-12-08 |
| CVE-2021-24019An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user ses…Fortinet · Fortinet FortiClientEMS · CVSS 8.1 · 2021-10-06 | 8.1 | 5.3% | 2021-10-06 |
| CVE-2021-3144In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)Saltstack · Salt · 2021-02-27 | – | 5.2% | 2021-02-27 |
| CVE-2020-8234A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling the attacker to obtain…Ui · EdgeSwitch firmware v1.9.0 and prior · 2020-08-21 | – | 3.4% | 2020-08-21 |
| CVE-2020-29667In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system becau…Lanatmservice · M3 Atm Monitoring System · 2020-12-10 | – | 3.2% | 2020-12-10 |
| CVE-2016-6545iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each requestiTrack · Easy · 2018-07-13 | – | 3.0% | 2018-07-13 |
| CVE-2021-3311An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the int…Octobercms · October · 2021-02-05 | – | 3.0% | 2021-02-05 |
| CVE-2017-6529An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.Dnatools · Dnalims · 2017-03-09 | – | 2.9% | 2017-03-09 |
| CVE-2024-48827An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function.Sbond · Watcharr · CVSS 8.8 · 2024-10-11 | 8.8 | 2.8% | 2024-10-11 |
| CVE-2017-12159It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session,…Red Hat, Inc. · keycloak · 2017-10-26 | – | 2.7% | 2017-10-26 |
| CVE-2020-9482If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client sid…Apache · Apache NiFi Registry · 2020-04-28 | – | 2.7% | 2020-04-28 |
| CVE-2018-21018Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.Joinmastodon · Mastodon · 2019-09-22 | – | 2.6% | 2019-09-22 |
| CVE-2021-25981Talkyard - Insufficient Session Expirationdebiki · talkyard · CVSS 9.8 · 2022-01-03 | 9.8 | 2.5% | 2022-01-03 |
| CVE-2016-11014NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.Netgear · Jnr1010 Firmware · 2019-10-16 | – | 2.5% | 2019-10-16 |
| CVE-2019-5462A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.GitLab · GitLab Community Edition and GitLab Enterprise Edition · 2020-01-28 | – | 2.5% | 2020-01-28 |
| CVE-2019-8149Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbi…Adobe Systems Incorporated · Magento 2 · 2019-11-05 | – | 2.5% | 2019-11-05 |
| CVE-2021-39113Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access C…Atlassian · Jira Server · CVSS 7.5 · 2021-08-30 | 7.5 | 2.5% | 2021-08-30 |
| CVE-2020-35358DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in a…Domainmod · Domainmod · 2021-03-15 | – | 2.4% | 2021-03-15 |
| CVE-2019-7280Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a va…Primasystems · Flexair · 2019-07-01 | – | 2.3% | 2019-07-01 |
| CVE-2013-0335Openstack nova: vnc proxy can connect to the wrong vmRed Hat · OpenStack Folsom for RHEL 6 · CVSS 7.6 · 2013-03-22 | 7.6 | 2.1% | 2013-03-22 |
| CVE-2019-1003049Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins…Jenkins project · Jenkins · 2019-04-10 | – | 2.1% | 2019-04-10 |
| CVE-2022-3080BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedlyISC · BIND9 · CVSS 7.5 · 2022-09-21 | 7.5 | 2.0% | 2022-09-21 |
| CVE-2017-15653Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized user to execute any a…Asus · Asuswrt · 2018-01-31 | – | 2.0% | 2018-01-31 |
| CVE-2020-12690An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is u…Openstack · Keystone · 2020-05-06 | – | 1.9% | 2020-05-06 |
| CVE-2019-12421When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side b…Apache · Apache NiFi · 2019-11-19 | – | 1.8% | 2019-11-19 |
| CVE-2020-27739A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported…Citadel · Webcit · 2020-10-28 | – | 1.8% | 2020-10-28 |
| CVE-2021-35214Session Management VulnerabilitySolarWinds · Pingdom · CVSS 4.8 · 2021-10-12 | 4.8 | 1.8% | 2021-10-12 |
| CVE-2021-34739Cisco Small Business Series Switches Session Credentials Replay VulnerabilityCisco · Cisco Small Business Smart and Managed Switches · CVSS 8.1 · 2021-11-04 | 8.1 | 1.7% | 2021-11-04 |
| CVE-2020-27416Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account.Mahadiscom · Mahavitaran · 2021-12-08 | – | 1.6% | 2021-12-08 |
| CVE-2021-25992ifme - Insufficient Session Expirationifmeorg · ifme · CVSS 9.8 · 2022-02-10 | 9.8 | 1.6% | 2022-02-10 |
| CVE-2021-21031Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized AccessAdobe · Magento.com · CVSS 5.6 · 2021-02-11 | 5.6 | 1.6% | 2021-02-11 |
| CVE-2018-11386An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The…Sensiolabs · Symfony · 2018-06-13 | – | 1.6% | 2018-06-13 |
| CVE-2020-6649An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain ad…Fortinet · Fortinet FortiIsolator · 2021-02-08 | – | 1.5% | 2021-02-08 |
| CVE-2024-0944Totolink T8 cstecgi.cgi session expirationTotolink · T8 · CVSS 3.7 · 2024-01-26 | 3.7 | 1.5% | 2024-01-26 |
| CVE-2021-38823The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different b…Icehrm · Icehrm · 2021-10-04 | – | 1.5% | 2021-10-04 |
| CVE-2021-21032Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized AccessAdobe · Magento Commerce · CVSS 5.6 · 2021-02-11 | 5.6 | 1.5% | 2021-02-11 |
| CVE-2022-41672Session still functional after user is deactivatedApache Software Foundation · Apache Airflow · 2022-10-07 | – | 1.5% | 2022-10-07 |
| CVE-2021-37333Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a sessio…Bookingcore · Booking Core · 2021-10-04 | – | 1.5% | 2021-10-04 |
| CVE-2018-6634A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized users to maintain access to an account.Parsecgaming · Parsec · 2019-05-07 | – | 1.5% | 2019-05-07 |
| CVE-2021-3183Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login profile.Files · Fat Client · 2021-01-19 | – | 1.4% | 2021-01-19 |
| CVE-2017-11667OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.Openproject · Openproject · 2017-07-26 | – | 1.4% | 2017-07-26 |
| CVE-2021-32923HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which…Hashicorp · Vault · 2021-06-03 | – | 1.4% | 2021-06-03 |
| CVE-2016-8712An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. The device uses one nonce for all session…Moxa · AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client · CVSS 5.9 · 2017-04-13 | 5.9 | 1.4% | 2017-04-13 |
| CVE-2021-1501Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software SIP Denial of Service VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 8.6 · 2021-04-29 | 8.6 | 1.4% | 2021-04-29 |
| CVE-2021-40849In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in informatio…Mahara · Mahara · 2021-11-03 | – | 1.4% | 2021-11-03 |
| CVE-2016-5069Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.Sierrawireless · Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 · 2017-04-10 | – | 1.3% | 2017-04-10 |
| CVE-2020-4284IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functio…IBM · Security Information Queue · CVSS 5.3 · 2020-04-08 | 5.3 | 1.3% | 2020-04-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.