Total
331 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-0991 | 1 Admidio | 1 Admidio | 2022-03-28 | 6.4 MEDIUM | 7.1 HIGH |
| Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. | |||||
| CVE-2022-24743 | 1 Sylius | 1 Sylius | 2022-03-22 | 6.4 MEDIUM | 8.2 HIGH |
| Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory. | |||||
| CVE-2022-24744 | 1 Shopware | 1 Shopware | 2022-03-17 | 3.5 LOW | 3.5 LOW |
| Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. | |||||
| CVE-2022-24732 | 1 Maddy Project | 1 Maddy | 2022-03-17 | 6.5 MEDIUM | 8.8 HIGH |
| Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms. | |||||
| CVE-2021-38986 | 1 Ibm | 1 Mq | 2022-03-09 | 5.5 MEDIUM | 5.4 MEDIUM |
| IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942. | |||||
| CVE-2022-24332 | 1 Jetbrains | 1 Teamcity | 2022-03-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. | |||||
| CVE-2022-24341 | 1 Jetbrains | 1 Teamcity | 2022-03-04 | 5.0 MEDIUM | 7.5 HIGH |
| In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. | |||||
| CVE-2021-25966 | 1 Orchardcore | 1 Orchard Core | 2022-02-25 | 6.5 MEDIUM | 8.8 HIGH |
| In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. | |||||
| CVE-2022-22113 | 1 Daybydaycrm | 1 Daybyday | 2022-02-25 | 6.5 MEDIUM | 8.8 HIGH |
| In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. | |||||
| CVE-2021-25992 | 1 If-me | 1 Ifme | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks. | |||||
| CVE-2021-22820 | 1 Schneider-electric | 12 Evlink City Evc1s22p4, Evlink City Evc1s22p4 Firmware, Evlink City Evc1s7p4 and 9 more | 2022-02-03 | 7.5 HIGH | 9.8 CRITICAL |
| A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2) | |||||
| CVE-2021-37866 | 1 Mattermost | 1 Mattermost Boards | 2022-02-03 | 5.0 MEDIUM | 7.5 HIGH |
| Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization. | |||||
| CVE-2022-22283 | 1 Samsung | 1 Health | 2022-01-19 | 2.1 LOW | 3.3 LOW |
| Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. | |||||
| CVE-2021-25981 | 1 Talkyard | 1 Talkyard | 2022-01-14 | 10.0 HIGH | 9.8 CRITICAL |
| In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks) | |||||
| CVE-2022-21652 | 1 Shopware | 1 Shopware | 2022-01-12 | 5.5 MEDIUM | 8.1 HIGH |
| Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue. | |||||
| CVE-2021-45885 | 1 Stormshield | 1 Network Security | 2022-01-11 | 4.3 MEDIUM | 7.5 HIGH |
| An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password. | |||||
| CVE-2021-35034 | 1 Zyxel | 2 Nbg6604, Nbg6604 Firmware | 2022-01-07 | 6.4 MEDIUM | 9.1 CRITICAL |
| An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted. | |||||
| CVE-2020-27416 | 1 Mahadiscom | 1 Mahavitaran | 2021-12-13 | 7.5 HIGH | 9.8 CRITICAL |
| Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account. | |||||
| CVE-2021-42545 | 1 Business-dnasolutions | 1 Topease | 2021-12-06 | 6.4 MEDIUM | 9.1 CRITICAL |
| An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions. | |||||
| CVE-2021-43791 | 1 Zulip | 1 Zulip | 2021-12-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a user to the check_prereg_key_and_redirect endpoint, before getting redirected to POST to /accounts/register/. The problem was that validation was happening in the check_prereg_key_and_redirect part and not in /accounts/register/ - meaning that one could submit an expired confirmation key and be able to register. The issue is fixed in Zulip 4.8. There are no known workarounds and users are advised to upgrade as soon as possible. | |||||