2020 matches found
RHEL 6 : MRG (RHSA-2014:0858)
An updated cumin package that fixes two security issues is now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...
cumin: session cookies lack httponly setting
It was found that Cumin did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...
cumin: session cookies lack httponly setting
It was found that Cumin did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...
Novell NetMail 3.x Automatic Script Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14171/info Novell NetMail email client is prone to an input validation vulnerability. Reports indicate that HTML and JavaScript attached to received email messages is executed automatically, when the email message is...
PHP <= 5.2.3 EXT/Session HTTP Response Header Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/24268/info PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to inject additional cookie attributes into session cookies...
openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0082-1)
This update fixes a cross-site scripting vulnerability that affects the session list screen. This can be used to steal session cookies because tomcat 6 does not use the httpOnly flag for its cookies. CVE-2010-4172 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...
Code injection
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a 1 expired or 2 invalidated cookie...
Khan Academy: CRLF Injection
Is it possible for a remote attacker to inject custom HTTP headers. For example, an attacker can inject session cookies or HTML code. This may conduct to vulnerabilities like XSS cross-site scripting or session fixation. PoC...
StopTheHacker: Reflected cross site scripting in login page
It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. Once exploited It is possible to steal or manipulate a legitimate user’s session credentials including session cookies. Request ...
Design/Logic Flaw
CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation...
CVE-2014-1257
CVE-2014-1257 affects CFNetwork cookies in Apple OS X up to 10.8.5. The vulnerability arises because Safari reset actions do not reliably remove session cookies, allowing a physically proximate attacker with an unattended workstation to bypass access restrictions. Publicly documented details in t...
CVE-2014-1257
CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation...
CTERA 3.2.29.0/3.2.42.0 - Persistent Cross-Site Scripting
Exploit Title: CTERA Project Folders - Stored XSS Date: 11-Mar-2013 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.ctera.com Version: 3.2.29.0 and 3.2.42.0 Tested on: ctera os CVE : CVE-2013-2639 OVERVIEW Standard Ctera User can define a particular “description” for a ProjectFolder tha...
CVE-2012-0264
op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to have an unspecified impact via unspecified vectors...
Design/Logic Flaw
op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to have an unspecified impact via unspecified vectors...
CVE-2012-0264
op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to have an unspecified impact via unspecified vectors...
CVE-2012-0264
CVE-2012-0264 affects op5 Monitor and op5 Appliance prior to version 5.5.0. The root cause is improper management of session cookies, which yields a remote impact with an unspecified vector and unspecified consequences (per the description). The NVD metrics indicate a high severity (CVSS 2.0: bas...
Mandriva Linux Security Advisory : mediawiki (MDVSA-2013:290)
Updated mediawiki packages fix security vulnerabilities : Kevin Israel Wikipedia user PleaseStand identified and reported two vectors for injecting JavaScript in CSS that bypassed MediaWiki's blacklist CVE-2013-4567, CVE-2013-4568. Internal review while debugging a site issue discovered that...
Design/Logic Flaw
CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...
CVE-2013-5167
CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...