Design/Logic Flaw

Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie...

CVE-2016-8023

Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote unauthenticated attacker to bypass server authentication via a crafted authentication cookie...

CVE-2016-8022

Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie...

CVE-2016-8023: Improper Authentication

Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote unauthenticated attacker to bypass server authentication via a crafted authentication cookie...

Open-Xchange AppSuite Information Disclosure Vulnerability (CNVD-2016-04299)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. An information disclosure vulnerability exists in OX AppSuite 7.8.1 and prior...

AIX OpenSSH Advisory : openssh_advisory8.asc

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities : - A remote code execution vulnerability exists in the sshd server component of OpenSSH due to improper sanitization of X11 authentication credentials. An authenticated, remote attacker can...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2016-00680)

IBM WebSphere Portal is a suite of enterprise portal solutions. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which allows remote attackers to exploit the vulnerability to inject malicious scripts that can steal the current user's authentication cookie when malicious data i...

phpMyAdmin Security Bypass Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A security vulnerability in the libraries/plugins/auth/AuthenticationCookie.class.php script in phpMyAdmin versions 4.3.13.2 prior to 4.3.x and 4.4.14.1 prior to 4.4.x can be exploited by a remote...

UBUNTU-CVE-2015-6830

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha...

Cross site scripting

Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attackers to obtain credential information via script access to this cookie, aka ZEN-10418...

CVE-2014-9250

CVE-2014-9250 affects Zenoss Core through 5 Beta 3, where the authentication cookie is sent without the HttpOnly flag in Set-Cookie. This exposes credential information to client-side script access, increasing risk of credential exposure. The document notes mitigation by enabling SSL/HTTPS to bet...

CVE-2014-9250

Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attackers to obtain credential information via script access to this cookie, aka ZEN-10418...

CVE-2014-9250: Exposure of Sensitive Information to an Unauthorized Actor

Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attackers to obtain credential information via script access to this cookie, aka ZEN-10418...

Advantech WebAccess Remote Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication requirements on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ChkCookieNoRedir function. By providing arbitrary values to certai...

PHP-Fusion Database Backup Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10974/info It is reported that PHP-Fusion is susceptible to a database backup information disclosure vulnerability. An anonymous remote attacker may be able to download a complete database backup from the server...

Firefox Java update ready to stop BEAST attacks

Firefox Java update ready to stop BEAST attacks Firefox developers searching for a way to protect users against a new attack that decrypts sensitive web traffic are seriously considering an update that stops the open-source browser from working with Oracle's Java software framework. Johnath, the...

Paessler PRTG Traffic Grapher 6.2.1.945 Cross Site Scripting

aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 08-Jun-2010 Software: Paessler - PRTG Traffic Grapher http://www.paessler.com "PRTG Network Monitor runs 24/7 on a Windows-based machine within your network, recording network usage parameters...

stash103exp.txt

!/usr/bin/perl -w User credentials disclosure exploit - stash103exp.pl Gnix http://gnix.netsons.org This exploit use an SQL Injection in the file admin/login.php to bypass the login, and then an SQL Injection in the admin/news.php to extract all the users info. Note: password are crypted with md5...

CVE-2008-1396: Undefined Security Weakness

Plone CMS 3.x uses invariant data a client username and a server secret when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network...

CVE-2007-4419

Admin.php in Olate Download od 3.4.1 uses an MD5 hash of the admin username, user id, and group id, to compose the OD3AutoLogin authentication cookie, which makes it easier for remote attackers to guess the cookie and access the Admin area...