CVE-2012-0264

CVE-2012-0264 affects op5 Monitor and op5 Appliance prior to version 5.5.0. The root cause is improper management of session cookies, which yields a remote impact with an unspecified vector and unspecified consequences (per the description). The NVD metrics indicate a high severity (CVSS 2.0: bas...

[Watcher] passive Web-security scanner

Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

Mandriva Linux Security Advisory : mediawiki (MDVSA-2013:290)

Updated mediawiki packages fix security vulnerabilities : Kevin Israel Wikipedia user PleaseStand identified and reported two vectors for injecting JavaScript in CSS that bypassed MediaWiki's blacklist CVE-2013-4567, CVE-2013-4568. Internal review while debugging a site issue discovered that...

HackerOne: Broken Authentication and session management OWASP A2

Description: Session management issue in https://www.hackerone.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his hackerone account.In secure web application,Cookies immediately expire once the user logs out of his account. But thi...

Apple Turns on BEAST Attack Mitigation by Default in Safari

Apple enabled a feature in its recent OS X Mavericks update that neutered the BEAST cryptographic attacks. BEAST is a two-year-old attack tool that exploits a vulnerability in TLS 1.0 and SSL 3.0 and could lead to an attacker stealing HTTPS cookies or hijacking browser sessions. Apple’s Safari...

Evernote: Wormable stored XSS in www.evernote.com

The Evernote iOS application leverages the Evernote API to synchronize notes with the backend. When a new note is created or updated, a request is submitted to the backend that wraps the note in an XML document. This request also contains metadata about which parts of the note is updated. The XML...

Design/Logic Flaw

CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...

CVE-2013-5167

CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...

CVE-2013-5167

CVE-2013-5167 concerns CFNetwork in Apple Mac OS X pre-10.9 where Safari’s deletion of session cookies is not properly handled during a reset, enabling remote servers to track users via Set-Cookie headers. Affected: CFNetwork on macOS before 10.9. Root cause: improper cookie deletion handling in ...

Claroline 1.11.8 Cross Site Scripting

Exploit Title: Claroline 1.11.8 Cross Site Scripting Date: 2013 11 October Author: Arsan Software Homepage: http://www.claroline.net Version : 1.11.8 Security Risk: High Tested on: Windows 8 Category: webapps Google Dork: intext:"Powered by Claroline" + Exploit : - About Claroline : Claroline is...

Cisco Unified Computing System Fabric Interconnect Cross-Site Request Forgery Vulnerability

A vulnerability in the fabric interconnect FI web management interface of the Cisco Unified Computing System could allow an unauthenticated, remote attacker to conduct cross-site request forgery CSRF attacks. The vulnerability occurs because the web interface relies on cookies to authenticate...

Samsung DVR authentication bypass

Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status: unpatched Samsung provides a wide range of DVR...

NSA using Browser Cookies to track Tor Users

Yesterday a new classified NSA document was leaked by Edward Snowden - titled 'Tor Stinks' in which ideas were being kicked around for identifying Tor users or degrading the user experience to dissuade people from using the Tor browser. The NSA had a very hard time while tracking down all Tor...

NSA using Browser Cookies to track Tor Users

Yesterday a new classified NSA document was leaked by Edward Snowden - titled ‘Tor Stinks’ in which ideas were being kicked around for identifying Tor users or degrading the user experience to dissuade people from using the Tor browser. The NSA had a very hard time while tracking down all Tor...

mod_pagespeed -- critical cross-site scripting (XSS) vulnerability

modpagespeed developers report: Various versions of modpagespeed are subject to critical cross-site scripting XSS vulnerability, CVE-2013-6111. This permits a hostile third party to execute JavaScript in users' browsers in context of the domain running modpagespeed, which could permit theft of...

Django Vulnerability Could Allow Attackers Access to Cookies

A security vulnerability in the web framework Django could make it easier for an attacker to steal a user’s cookie and log into their website even after they’ve logged out. The session invalidation vulnerability was discovered by G.S. McNamara, the same researcher who dug up a similar vulnerabili...

LinkedIn Cross Site Scripting

============================================= INTERNET SECURITY AUDITORS ALERT 2012-003 - Original release date: 16th December 2012 - Last revised: 26th September 2013 - Discovered by: Eduardo Garcia Melia - Severity: 6.8/10 CVSS Base Scored ============================================= I...

CVE-2013-4024

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network...

Design/Logic Flaw

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network...

CVE-2013-4024

CVE-2013-4024 affects IBM Data Studio Web Console (3.x before 3.2), Optim Performance Manager (5.x before 5.2), InfoSphere Optim Configuration Manager (2.x before 2.2), and DB2 Recovery Expert (2.x). The issue arises from the Web Console serving over HTTP, allowing remote attackers to read sessio...