96 matches found
CVE-2014-3702
Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of service resource consumption via a .. dot dot the session parameter...
CVE-2014-3702: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of service resource consumption via a .. dot dot the session parameter...
CVE-2017-11458
Cross-site scripting XSS vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783...
forumsirius.fr XSS vulnerability
Vulnerable URL: http://www.forumsirius.fr/orion/mc2.phtml?session=7dcraurb0d3csc19b7rs1lpmj2="--!" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 21.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 148207 VIP website status:| No Che...
CVE-2016-2840
An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context...
CVE-2016-2840: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context...
Pivotx Session Fixation Vulnerability
Pivotx is an open source blog content management system Blog CMS. The system supports built-in comment review, spam protection and template replacement. A session fixation vulnerability exists in the fileupload.php file in Pivotx versions prior to 2.3.11. A remote attacker can exploit this...
CVE-2013-4562
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...
CVE-2013-4562
The CVE-2013-4562 weakness affects the omniauth-facebook gem (versions 1.4.1 prior to 1.5.0). The root cause is that the session parameter is not properly stored, enabling remote attackers to perform CSRF via the state parameter. Consequences include potential CSRF attacks against users authentic...
CVE-2013-4562
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...
DEBIAN-CVE-2013-6172
steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...
UBUNTU-CVE-2013-6172
steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...
Debian DSA-2787-1 : roundcube - design error
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing rand...
Debian Security Advisory DSA 2787-1 (roundcube - design error)
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing rand...
Debian: Security Advisory (DSA-2787-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Alt-N MDaemon WorldClient / WebAdmin Cross Site Request Forgery
===================================================================================== Alt-N MDaemon's WorldClient & WebAdmin Cross-Site Request Forgery Vulnerability ===================================================================================== Software: Alt-N MDaemon v13.0.3 and prior...
CVE-2010-5010
Cross-site scripting XSS vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to inject arbitrary web script or HTML via the session parameter...
Sql injection
SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arbitrary SQL commands via the session parameter...
