CWE-613

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@cyyynthia/tokenize"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.1.0"
            },
            {
              "fixed": "1.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-08T21:09:02Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nA bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the `lastTokenReset` field.\n\n### Patches\nVersion 1.1.3 contains a patch that\u0027ll invalidate these faulty tokens and make new ones behave as expected.\n\n### Workarounds\nNone. Tokens do not hold the necessary information to perform invalidation anymore.\n\n### References\nPR #1\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/cyyynthia/tokenize](https://github.com/cyyynthia/tokenize)\n* Email us at [cynthia@cynthia.dev](mailto:cynthia@cynthia.dev)\n",
  "id": "GHSA-jcjx-c3j3-44pr",
  "modified": "2021-11-08T21:09:02Z",
  "published": "2021-11-10T16:44:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cyyynthia/tokenize/security/advisories/GHSA-jcjx-c3j3-44pr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cyyynthia/tokenize"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Insufficient Session Expiration in @cyyynthia/tokenize"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mage-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.9.73"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-266",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-23T22:51:28Z",
    "nvd_published_at": "2024-08-23T19:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server.",
  "id": "GHSA-jg95-r9xh-xw9c",
  "modified": "2025-10-13T15:45:48Z",
  "published": "2024-08-23T21:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45187"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mage-ai/mage-ai"
    },
    {
      "type": "WEB",
      "url": "https://research.jfrog.com/vulnerabilities/mage-ai-deleted-users-rce-jfsa-2024-001039602"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Mage AI incorrectly gives privileges to users with deleted accounts"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-45885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-29T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password.",
  "id": "GHSA-jg98-xfvf-7pvv",
  "modified": "2022-01-12T00:02:13Z",
  "published": "2021-12-30T00:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45885"
    },
    {
      "type": "WEB",
      "url": "https://advisories.stormshield.eu"
    },
    {
      "type": "WEB",
      "url": "https://advisories.stormshield.eu/2021-069"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-51953"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-31T22:17:02Z",
    "severity": "HIGH"
  },
  "details": "An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components",
  "id": "GHSA-jhhh-39pj-vgq6",
  "modified": "2026-08-03T18:30:37Z",
  "published": "2026-08-01T00:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51953"
    },
    {
      "type": "WEB",
      "url": "https://github.com/altamish1994/CVE_Published/blob/main/FeehiCMS/CVE-2026-51953.MD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liufee/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-46040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-07T16:15:05Z",
    "severity": "MODERATE"
  },
  "details": "IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.",
  "id": "GHSA-jjx8-fgcm-mhjx",
  "modified": "2024-11-05T00:31:27Z",
  "published": "2024-10-07T18:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46040"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Anonymous120386/Anonymous"
    },
    {
      "type": "WEB",
      "url": "https://www.iothaat.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.24.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "mantisbt/mantisbt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.24.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2009-20001"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-28T23:02:24Z",
    "nvd_published_at": "2021-03-07T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user\u0027s cookie to login as them.",
  "id": "GHSA-jm72-67rm-763j",
  "modified": "2025-06-09T17:48:33Z",
  "published": "2022-04-21T01:54:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-20001"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mantisbt/mantisbt/commit/79a78c09d5ef5ce098adc73f6f1416f00fc238a5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mantisbt/mantisbt"
    },
    {
      "type": "WEB",
      "url": "https://mantisbt.org/bugs/view.php?id=11296"
    },
    {
      "type": "WEB",
      "url": "https://mantisbt.org/bugs/view.php?id=27976"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MantisBT Insufficient Session Expiration cookie string not reset after logout"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-33137"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-12T10:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SIMATIC MV540 H (All versions \u003c V3.3), SIMATIC MV540 S (All versions \u003c V3.3), SIMATIC MV550 H (All versions \u003c V3.3), SIMATIC MV550 S (All versions \u003c V3.3), SIMATIC MV560 U (All versions \u003c V3.3), SIMATIC MV560 X (All versions \u003c V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users\u0027 sessions.",
  "id": "GHSA-jp3h-x882-5crh",
  "modified": "2022-07-16T00:00:23Z",
  "published": "2022-07-13T00:01:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33137"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3401"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T01:16:02Z",
    "severity": "LOW"
  },
  "details": "A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipulation causes session expiration. Remote exploitation of the attack is possible. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks.",
  "id": "GHSA-jp9r-hwvp-x6c8",
  "modified": "2026-03-02T03:30:20Z",
  "published": "2026-03-02T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3401"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hiranerakkot/Web-based-Pharmacy-Product-Management-System/blob/main/README.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.348296"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.348296"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.762795"
    },
    {
      "type": "WEB",
      "url": "https://www.sourcecodester.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-14007"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-17T22:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user\u0027s session is available for an extended period beyond the last activity, allowing an attacker to reuse an old session for authorization.",
  "id": "GHSA-jrvx-j527-53gx",
  "modified": "2022-05-13T01:37:41Z",
  "published": "2022-05-13T01:37:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14007"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-285-01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/101259"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-27422"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-16T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn\u0027t expire once used, allowing an attacker to use the same link to takeover the account.",
  "id": "GHSA-jvmc-9qmp-g6pw",
  "modified": "2022-05-24T17:34:17Z",
  "published": "2022-05-24T17:34:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27422"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html"
    },
    {
      "type": "WEB",
      "url": "https://www.anuko.com/time-tracker/index.htm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}