CWE:

	Topic	Date	Author
Low	Microsoft Office 365 Enterprise E3 Insufficient Session Expiration	09.07.2017	Micha Borrmann

---

CVEMAP Search Results

CVE

Details

Description

2019-11-19

Medium

CVE-2019-12421

Vendor: Apache Software: NIFI

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.

2019-11-14

Medium

CVE-2019-11168

Updating...

Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.

2019-10-09

Medium

CVE-2019-17375

Vendor: Cpanel Software: Cpanel

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

2019-09-22

Medium

CVE-2018-21018

Vendor: Joinmastodon Software: Mastodon

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

2019-09-18

Medium

CVE-2019-5531

Vendor: Vmware Software: Vcenter server

VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user?s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.

2019-09-17

Low

CVE-2019-14826

Vendor: Freeipa Software: Freeipa

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.

2019-09-08

Low

CVE-2019-16133

Vendor: Weaver Software: Eteams oa

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/.

2019-08-21

Medium

CVE-2019-5638

Vendor: Rapid7 Software: Nexpose

Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.

2019-07-01

Low

CVE-2019-7280

Vendor: Primasystems Software: Flexair

Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session and bypass authentication.

2019-06-06

Medium

CVE-2019-7215

Updating...

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.

 

---

Copyright 2019, cxsecurity.com