Security Bulletin: Multiple Security Vulnerabilities affect IBM Security Privileged Identity Manager Virtual Appliance

Summary There are multiple security vulnerabilities in various components fixed in the IBM Security Privileged Identity Manager Virtual Appliance Vulnerability Details CVEID: CVE-2016-0378 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive...

Security Bulletin: A Security vulnerability has been fixed in IBM Security Privileged Identity Manager (CVE-2016-0353)

Summary Security Vulenerability fixed in IBM Security Privileged Identity Manager related to session cookies in SSL mode. Vulnerability Details CVEID: CVE-2016-0353 DESCRIPTION: IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive informatio...

CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...

CVE-2018-10966

An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard coded secret...

Grab: Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.com

Good day, I truly hope it treats you awesomely on your side of the screen : I have found that your website cdn.grab.com is pointed via a cname to a cloudfront instance cdn.grab.com = .cloudfront.net This was not registered on Amazon Aws Cloudfront. I was able to take over the domain: See my POC P...

Advantech WebAccess Source Validation Error Vulnerability

Advantech WebAccess, etc. are products of Advantech, Advantech WebAccess is a set of HMI/SCADA software based on the browser architecture, which supports dynamic graphic display and real-time data control, and provides remote control and management of automation devices. The software supports...

Input validation

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may...

CVE-2018-10591

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may...

CVE-2018-10591

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may...

CVE-2018-10591

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may...

Session Fixation

ec-cube/ec-cube is vulnerable to session fixation attacks. The vulnerability exists due to the lack of renewal of session cookies, allowing attackers to impersonate an authenticated user...

ServiceNow ITSM Cross-Site Scripting Vulnerability

ServiceNow ITSM is an IT service management system. The system features incident management, problem management, asset and cost management. A cross-site scripting vulnerability exists in ServiceNow ITSM version 2016-06-02. A remote attacker can exploit the vulnerability to obtain cookies for othe...

Arbitrary User Password Reset and Reflective Cross-site Scripting Vulnerabilities in zzcms System

Webmaster Merchants Content Management System ZZCMS developed by the ZZCMS team, into the database optimization, content caching, AJAX and other technologies, open source, independent functional modules, to facilitate secondary development. zzcms system exists arbitrary user password reset and...

Epson AirPrint Cross-Site Scripting Vulnerability Vulnerability

EPSON AirPrint is an application for wireless printing from Epson Japan. A cross-site scripting vulnerability exists in versions of Epson AirPrint prior to January 19, 2018 . A remote attacker could exploit the vulnerability to hijack session cookies...

Open source PHP message feedback management system has XSS vulnerability

Open source PHP message feedback management system is a second development by avenjan a set of small and medium-sized enterprises and personal website for the message feedback management program system , based on PHP MySQL + Bootstrap development , open source and free to use . Open source PHP...

Ipswitch MoveIt Cross-Site Request Forgery Vulnerability

Ipswitch MoveIt is a suite of automated file transfer software from Ipswitch USA. It supports the control, management, and viewing of all business-critical file transfer activities through a single, secure system. A cross-site request forgery vulnerability exists in Ipswitch MoveIt version 8.1. A...

CVE-2016-3957

The secureload function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryptionkey...

PT-2018-4911

Name of the Vulnerable Software and Affected Versions web2py versions prior to 2.14.2 Description The issue allows remote attackers to execute arbitrary code by leveraging knowledge of encryption key, potentially through deserialization of session information stored in cookies using the...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

Cross site scripting

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...