Vulnerabilities > Rapid7 > Nexpose > 6.4.36

DATE CVE VULNERABILITY TITLE RISK
2019-08-21 CVE-2019-5638 Insufficient Session Expiration vulnerability in Rapid7 Nexpose
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user.
network
low complexity
rapid7 CWE-613
8.8
8.8
2017-12-14 CVE-2017-5264 Cross-Site Request Forgery (CSRF) vulnerability in Rapid7 Nexpose
Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.
network
rapid7 CWE-352
6.8
6.8
2017-06-06 CVE-2017-5243 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Rapid7 Nexpose
The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions.
network
rapid7 CWE-327
6.8
6.8