CWE:
 

Topic
Date
Author
Low
Microsoft Office 365 Enterprise E3 Insufficient Session Expiration
09.07.2017
Micha Borrmann


CVEMAP Search Results

CVE
Details
Description
2019-10-09
Medium
CVE-2019-17375

Vendor: Cpanel
Software: Cpanel
 

 
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

 
2019-09-22
Medium
CVE-2018-21018

Vendor: Joinmastodon
Software: Mastodon
 

 
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

 
2019-09-18
Medium
CVE-2019-5531

Vendor: Vmware
Software: Vcenter server
 

 
VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user?s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.

 
2019-09-17
Low
CVE-2019-14826

Vendor: Freeipa
Software: Freeipa
 

 
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.

 
2019-09-08
Low
CVE-2019-16133

Vendor: Weaver
Software: Eteams oa
 

 
An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/.

 
2019-08-21
Medium
CVE-2019-5638

Vendor: Rapid7
Software: Nexpose
 

 
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.

 
2019-07-01
Low
CVE-2019-7280

Vendor: Primasystems
Software: Flexair
 

 
Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session and bypass authentication.

 
2019-06-06
Medium
CVE-2019-3790

Vendor: Pivotal software
Software: Operations m...
 

 
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

 
Medium
CVE-2019-7215

Updating...
 

 
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.

 
2019-05-09
Medium
CVE-2019-4072

Vendor: IBM
Software: Spectrum control
 

 
IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064.

 

 


Copyright 2019, cxsecurity.com

 

Back to Top