CWE-613 in Authentication
- CVEs
- 652
- Exploited
- 0
- Public check
- 0
- Likely
- 2
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-15950Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout. | Immuta · Immuta | Possible | – | 1.3% | 2020-11-05 |
| CVE-2022-25590SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exi… | Surveyking · Surveyking | Possible | – | 1.3% | 2022-03-25 |
| CVE-2021-25970Camaleon CMS - Insufficient Session Expiration after Password Change | camaleon_cms · camaleon_cms | Possible | 8.8 | 1.3% | 2021-10-20 |
| CVE-2023-50270Apache DolphinScheduler: Session do not expire after password change | Apache Software Foundation · Apache DolphinScheduler | Possible | 6.5 | 1.3% | 2024-02-20 |
| CVE-2021-26921In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled. | Argoproj · Argo Cd | Possible | – | 1.3% | 2021-02-09 |
| CVE-2022-31050Insufficient Session Expiration in TYPO3 Admin Tool | TYPO3 · typo3 | Possible | 6.0 | 1.3% | 2022-06-14 |
| CVE-2018-1127Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attack… | Red Hat · Red Hat Gluster Storage | Possible | 4.2 | 1.3% | 2018-09-11 |
| CVE-2022-2713Insufficient Session Expiration in cockpit-hq/cockpit | cockpit-hq · cockpit-hq/cockpit | Possible | 8.6 | 1.3% | 2022-08-08 |
| CVE-2022-24743Insufficient Session Expiration in Sylius | Sylius · Sylius | Possible | 7.1 | 1.3% | 2022-03-14 |
| CVE-2017-12867The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the pr… | Simplesamlphp · Simplesamlphp | Possible | – | 1.3% | 2017-08-29 |
| CVE-2022-2064Insufficient Session Expiration in nocodb/nocodb | nocodb · nocodb/nocodb | Possible | 9.1 | 1.2% | 2022-06-13 |
| CVE-2022-23063Shopizer - Insufficient Session Expiration | shopizer-ecommerce · Shopizer | Possible | 8.8 | 1.2% | 2022-05-03 |
| CVE-2020-13299A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a… | GitLab · GitLab | Possible | 8.1 | 1.2% | 2020-09-14 |
| CVE-2016-11058The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs. | Netgear · Genie | Possible | – | 1.2% | 2020-04-28 |
| CVE-2024-22543An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET request to the /goform/* URI or via the E… | Linksys · E1700 Firmware | Possible | 6.1 | 1.2% | 2024-02-27 |
| CVE-2024-50562An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions… | Fortinet · FortiOS | Possible | 4.4 | 1.2% | 2025-06-10 |
| CVE-2021-33322In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a u… | Liferay · Liferay Portal | Possible | – | 1.2% | 2021-08-03 |
| CVE-2021-36330Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentially exploit this vulne… | Dell · Dell EMC Streaming Data Platform | Possible | 8.1 | 1.2% | 2021-11-30 |
| CVE-2020-17474A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, elevate users to administrator… | Zkteco · Zkbiosecurity Server | Possible | – | 1.2% | 2020-08-14 |
| CVE-2019-12001A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2… | Hpe · HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; H… | Possible | – | 1.2% | 2020-04-17 |
| CVE-2015-5171The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to… | Cloudfoundry · Cf-Release | Possible | – | 1.2% | 2017-10-24 |
| CVE-2020-4995IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from another users' sessi… | IBM · Security Identity Governance and Intelligence | Possible | 4.0 | 1.2% | 2021-02-09 |
| CVE-2019-19199REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout. | Reddoxx · Maildepot | Possible | – | 1.2% | 2020-10-02 |
| CVE-2023-31065Apache InLong: Insufficient Session Expiration in InLong | Apache Software Foundation · Apache InLong | Possible | 9.1 | 1.2% | 2023-05-22 |
| CVE-2025-24859Apache Roller: Insufficient Session Expiration on Password Change | Apache Software Foundation · Apache Roller | Possible | 2.1 | 1.2% | 2025-04-14 |
| CVE-2020-24713Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. | Getgophish · Gophish | Possible | – | 1.2% | 2020-10-28 |
| CVE-2022-30699Novel "ghost domain names" attack by updating almost expired delegation information | NLnet Labs · Unbound | Possible | – | 1.2% | 2022-08-01 |
| CVE-2022-30698Novel "ghost domain names" attack by introducing subdomain delegations | NLnet Labs · Unbound | Possible | – | 1.2% | 2022-08-01 |
| CVE-2018-2451XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolonged period of validi… | SAP · SAP HANA Extended Application Services | Possible | – | 1.1% | 2018-08-14 |
| CVE-2021-42545Insufficient Session Expiration in TopEase | Business-DNA Solutions GmbH · TopEase | Possible | 8.1 | 1.1% | 2021-11-30 |
| CVE-2021-25979Apostrophe - Insufficient Session Expiration | Apostrophe · Apostrophe | Possible | 9.8 | 1.1% | 2021-11-08 |
| CVE-2020-13302A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a maliciou… | GitLab · GitLab | Possible | 3.8 | 1.1% | 2020-09-14 |
| CVE-2021-33982An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other u… | Myfwc · Fish | Hunt Fl | Possible | – | 1.1% | 2021-09-08 |
| CVE-2021-35342The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the sy… | Northern.tech · Useradm | Possible | – | 1.1% | 2021-08-27 |
| CVE-2022-3362Insufficient Session Expiration in ikus060/rdiffweb | ikus060 · ikus060/rdiffweb | Possible | 6.1 | 1.1% | 2022-11-14 |
| CVE-2021-22820A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web s… | Schneider-Electric · Evlink City Evc1s22p4 Firmware | Possible | – | 1.1% | 2022-01-28 |
| CVE-2021-35034An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be in… | Zyxel · NBG6604 series firmware | Possible | 7.4 | 1.1% | 2021-12-29 |
| CVE-2019-17375cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). | Cpanel · Cpanel | Possible | – | 1.1% | 2019-10-09 |
| CVE-2018-10990On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" c… | Commscope · Arris Tg1682g Firmware | Possible | – | 1.1% | 2018-05-14 |
| CVE-2022-31145Insufficient AccessToken Expiration Check in FlyteAdmin | flyteorg · flyteadmin | Possible | 6.5 | 1.1% | 2022-07-13 |
| CVE-2022-23669A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. A… | Arubanetworks · Aruba ClearPass Policy Manager | Possible | – | 1.1% | 2022-05-17 |
| CVE-2022-22113DayByDay CRM - Insufficient Session Expiration after Password Change | Bottelet · DaybydayCRM | Possible | 8.8 | 1.1% | 2022-01-13 |
| CVE-2021-25966Orchard Core CMS - Improper Session Termination after Password Change | OrchardCore · Users | Possible | 8.8 | 1.1% | 2021-10-10 |
| CVE-2024-13996Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change | Nagios · XI | Possible | 9.2 | 1.1% | 2025-10-30 |
| CVE-2020-6644An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should… | Fortinet · Fortinet FortiDeceptor | Possible | – | 1.1% | 2020-06-22 |
| CVE-2017-6145iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization… | F5 Networks, Inc. · F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe | Possible | – | 1.1% | 2017-10-20 |
| CVE-2019-7215Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. T… | Progress · Sitefinity | Possible | – | 1.1% | 2019-06-06 |
| CVE-2023-24426Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. | Jenkins Project · Jenkins Azure AD Plugin | Possible | 8.8 | 1.0% | 2023-01-24 |
| CVE-2020-0621A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows Security Feature Bypass Vulnerability'. | Microsoft · Windows | Possible | – | 1.0% | 2020-01-14 |
| CVE-2023-49935An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level auth… | Schedmd · Slurm | Possible | – | 1.0% | 2023-12-14 |
Data as of 2026-11-15.