CWE:
 

Topic
Date
Author
Low
Microsoft Office 365 Enterprise E3 Insufficient Session Expiration
09.07.2017
Micha Borrmann


CVEMAP Search Results

CVE
Details
Description
2020-02-07
Medium
CVE-2020-1768

Vendor: OTRS
Software: OTRS
 

 
The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions.

 
2020-01-22
Low
CVE-2019-5647

Vendor: Rapid7
Software: Appspider
 

 
The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.

 
2020-01-14
Low
CVE-2020-0621

Vendor: Microsoft
Software: Windows 10
 

 
A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows Security Feature Bypass Vulnerability'.

 
2019-12-18
Medium
CVE-2019-11106

Vendor: Intel
Software: Converged se...
 

 
Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access.

 
Medium
CVE-2019-8803

Vendor: Apple
Software: Ipados
 

 
An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A local attacker may be able to login to the account of a previously logged in user without valid credentials..

 
2019-11-19
Medium
CVE-2019-12421

Vendor: Apache
Software: NIFI
 

 
When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.

 
2019-11-14
Medium
CVE-2019-11168

Updating...
 

 
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.

 
2019-10-09
Medium
CVE-2019-17375

Vendor: Cpanel
Software: Cpanel
 

 
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

 
2019-09-22
Medium
CVE-2018-21018

Vendor: Joinmastodon
Software: Mastodon
 

 
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

 
2019-09-18
Medium
CVE-2019-5531

Vendor: Vmware
Software: Vcenter server
 

 
VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user?s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.

 

 


Copyright 2020, cxsecurity.com

 

Back to Top