CWE-613

{
  "affected": [],
  "aliases": [
    "CVE-2022-24332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-25T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains TeamCity before 2021.2, a logout action didn\u0027t remove a Remember Me cookie.",
  "id": "GHSA-xj6r-wv4q-mrm6",
  "modified": "2022-03-05T00:00:56Z",
  "published": "2022-02-26T00:00:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24332"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-25992"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-10T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Ifme, versions 1.0.0 to v.7.33.2 don\u2019t properly invalidate a user\u2019s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.",
  "id": "GHSA-xmp3-76fc-6jhm",
  "modified": "2022-02-11T00:00:46Z",
  "published": "2022-02-11T00:00:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25992"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-11014"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-16T11:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.",
  "id": "GHSA-xpqj-27x8-277f",
  "modified": "2022-05-24T16:58:48Z",
  "published": "2022-05-24T16:58:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-11014"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cybersecurityworks/Disclosed/issues/14"
    },
    {
      "type": "WEB",
      "url": "https://cybersecurityworks.com/zerodays/cve-2016-11014-netgear.html"
    },
    {
      "type": "WEB",
      "url": "https://khalil-shreateh.com/khalil.shtml/it-highlights/593-Netgear-1.0.0.24-Bypass---Improper-Session-Management--.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.openwall.net/full-disclosure/2016/01/11/5"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/135216/Netgear-1.0.0.24-Bypass-Improper-Session-Management.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0942"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-26T20:15:54Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was found in Totolink N200RE V5 9.3.5u.6255_B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-252186 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-xqqg-x653-vrx5",
  "modified": "2024-04-01T09:30:31Z",
  "published": "2024-01-26T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0942"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1oWAGbmDtHDIUN1WSRAh4ZnuzHOuvTU4T/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.252186"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.252186"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.269679"
    },
    {
      "type": "WEB",
      "url": "https://youtu.be/b0tU2CiLbnU"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15552"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-16T14:17:56Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient Session Expiration in Truesec\u2019s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.",
  "id": "GHSA-xqrw-v83c-fjpf",
  "modified": "2026-04-20T15:31:50Z",
  "published": "2026-03-16T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15552"
    },
    {
      "type": "WEB",
      "url": "https://labs.reversec.com/advisories/2026/03/long-session-lifetime-in-truesec-lapswebui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-45600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-05T12:15:47Z",
    "severity": "MODERATE"
  },
  "details": "A CWE-613 \u201cInsufficient Session Expiration\u201d vulnerability in the web application, due to the session cookie \u201csessionid\u201d lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.",
  "id": "GHSA-xrgp-j4fj-fqwr",
  "modified": "2025-04-23T18:30:52Z",
  "published": "2024-03-05T12:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45600"
    },
    {
      "type": "WEB",
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45600"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/heroiclabs/nakama"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.12.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-2306"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T19:58:37Z",
    "nvd_published_at": "2022-07-05T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "Old session tokens can be used to authenticate to the application and send authenticated requests.",
  "id": "GHSA-xv59-gc3r-rf92",
  "modified": "2022-07-15T20:44:19Z",
  "published": "2022-07-06T00:00:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2306"
    },
    {
      "type": "WEB",
      "url": "https://github.com/heroiclabs/nakama/commit/ce8d3921e2acd44ef8b5e6edfe595b6df067b166"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/heroiclabs/nakama/v3"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/35acf263-6db4-4310-ab27-4c3c3a53f796"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Insufficient Session Expiration in Nakama"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3844"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-24T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user\u0027s password is changed by an administrator due to an otherwise unrelated credential leak, that user account\u0027s current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage. This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638.",
  "id": "GHSA-xwrh-gfhf-9mw4",
  "modified": "2023-03-30T18:30:30Z",
  "published": "2023-03-24T18:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3844"
    },
    {
      "type": "WEB",
      "url": "https://docs.rapid7.com/insightvm/enable-insightvm-platform-login"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/cverecord?id=CVE-2019-5638"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-1000131"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-03T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle (when using MNet) as Mahara did not properly implement one of the MNet SSO API functions.",
  "id": "GHSA-xx52-3mch-r5wp",
  "modified": "2022-05-13T01:40:57Z",
  "published": "2022-05-13T01:40:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000131"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/mahara/+bug/1084336"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:wso2id-oauth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-33005"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-384",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-17T03:46:29Z",
    "nvd_published_at": "2023-05-16T17:15:12Z",
    "severity": "HIGH"
  },
  "details": "Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login.\n\nThis allows attackers to use social engineering techniques to gain administrator access to Jenkins.\n\nAs of publication of this advisory, there is no fix.",
  "id": "GHSA-xxq2-74hw-vg6m",
  "modified": "2023-05-17T03:46:29Z",
  "published": "2023-05-16T18:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33005"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2991"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins WSO2 Oauth Plugin Session Fixation vulnerability"
}