Code injection

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka...

CVE-2015-4306: Undefined Security Weakness

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka...

Cisco Ironport Security Appliance Default Host Key Vulnerability

The remote Cisco security appliance uses a default host key that is shared among all installations of the product. An unauthenticated, remote attacker with knowledge of the private key can impersonate other devices or perform a man-in-the-middle attack between this host and other virtual security...

Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability

A vulnerability in the remote support functionality of Cisco WSAv, Cisco ESAv, and Cisco SMAv Software could allow an unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliances. The vulnerability is due to the presence of...

Attackers able to impersonate users

There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment For reference, this issue has been assigned ID CVE-2015-2964...

SQL Server stored procedure Hacking（II）of the user to impersonate-vulnerability warning-the black bar safety net

Security pulse in the before provides SQL Server stored procedure Hacking series the first portion of the SQL Server stored procedure Hacking I of trusted database, now to translate the SQL Server stored procedure Hacking（II）of the user to impersonate on Application developers often use SQL Serve...

PT-2014-6394

Name of the Vulnerable Software and Affected Versions Adaptive Computing Moab versions prior to 7.2.9 Adaptive Computing Moab version 8 before 8.0.0 Description The issue allows remote attackers to bypass the signature check, impersonate arbitrary users, and execute commands via a message without...

CVE-2014-5375: Improper Input Validation

The server in Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 does not properly validate the message owner matches the submitting user, which allows remote authenticated users to impersonate arbitrary users via the UserId and Owner tags...

CVE-2014-5376: Improper Input Validation

Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matches the actor in the message, which allows remote authenticated users to impersonate arbitrary users via the actor field in a message...

Moab Dynamic Configuration Authentication Bypass

Moab Authentication Bypass : CVE-2014-5300 Software: Moab Affected Versions: All versions prior to Moab 7.2.9 and Moab 8 CVE Reference: CVE-2014-5300 Author: John Fitzpatrick, MWR Labs http://labs.mwrinfosecurity.com/ Severity: High Risk Vendor: Adaptive Computing Vendor Response: Resolved in Moa...

SIRCD Server 0.5.2/0.5.3 Operator Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9097/info sircd has been reported prone to a privilege escalation vulnerability. It has been reported that any user logged on to the sircd server, may set their usermode to +o, or operator mode. An attacker may exploit th...

PT-2014-3297

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF versions prior to 1.1.19 Simple Machines Forum SMF versions 2.x prior to 2.0.6 Description The issue allows remote attackers to impersonate arbitrary users by utilizing multiple space characters. Recommendations For...

Authentication flaw

The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request...

CVE-2014-0188

The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request...

Updated moodle packages fix multiple security vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.4.9, question strings were not being filtered correctly possibly allowing cross site scripting, as quizquestiontostring can cause invalid HTML CVE-2014-2571. Feedback Availability dates not honored in complete.php in Moodle...

PT-2014-3863

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 2.5.4 Cybozu Garoon versions 3.x through 3.7 SP3 Description The issue is related to improper session management, which allows remote authenticated users to impersonate arbitrary users. Recommendations For...

PYSEC-2013-14

Salt aka SaltStack before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key...

Null pointer dereference

The comparedn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows 1 remote attackers to cause a denial of service out-of-bounds read, NULL pointer dereference, and daemon crash or 2 remote authenticated users to impersonate arbitrary users and bypass access restrictions vi...

CVE-2013-0579: Undefined Security Weakness

The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote attackers to impersonate arbitrary users by leveraging access to a legitimate user's web browser either 1 before or 2 after authentication...

JVN#00985872: EC-CUBE vulnerable to session fixation

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability. Impact A remote unauthenticated attacker may impersonate a user. As a result, information may be disclosed or altered. Solution Apply the update or patch Apply...