CVE-2013-5167

CVE-2013-5167 concerns CFNetwork in Apple Mac OS X pre-10.9 where Safari’s deletion of session cookies is not properly handled during a reset, enabling remote servers to track users via Set-Cookie headers. Affected: CFNetwork on macOS before 10.9. Root cause: improper cookie deletion handling in ...

Claroline 1.11.8 Cross Site Scripting

Exploit Title: Claroline 1.11.8 Cross Site Scripting Date: 2013 11 October Author: Arsan Software Homepage: http://www.claroline.net Version : 1.11.8 Security Risk: High Tested on: Windows 8 Category: webapps Google Dork: intext:"Powered by Claroline" + Exploit : - About Claroline : Claroline is...

CVE-2013-4024

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network...

Design/Logic Flaw

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network...

CVE-2013-4024

CVE-2013-4024 affects IBM Data Studio Web Console (3.x before 3.2), Optim Performance Manager (5.x before 5.2), InfoSphere Optim Configuration Manager (2.x before 2.2), and DB2 Recovery Expert (2.x). The issue arises from the Web Console serving over HTTP, allowing remote attackers to read sessio...

CVE-2013-4024

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network...

Xoops 2.5.6 Cross Site Scripting

Xoops 2.5.6 Multiple XSS vulnerabilities ------------------------------------------------------------ == Description == - Software link: http://xoops.org/ - Affected versions: version 2.5.6last version is vulnerable. Other versions might be affected as well. - Vulnerability discovered by: Mehdi...

live800聊天窗口定向xss（本地域权限）

简要描述： 可以给客服发送xss。 详细说明： 可以给客服发送xss，但是服务端那边是直接运行html的，没有cookie，不过可以给客服发网马代码之类的。 漏洞证明： 插入个表情，然后修改元素，插入xss，发送。 收到了 可以看对方系统，IE版本。 可以找相应的exp挂马。...

Authentication bypass in D-Link devices (session cookies not validated)

Vendor: D-Link Affected Products: -DIR-505L SharePort Mobile Companion HW: A1 / FW: 1.01 -DIR-826L Wireless N600 Cloud Router HW: A1 / FW: 1.02 Vendor Notification: April 8, 2013 Public Disclosure: July 8, 2013 Vulnerability Type: Authentication Bypass CVE Reference: CVE-2013-4772 Solution Status...

analyze_cookies

This plugin greps every response for session cookies that the web application sends to the client, and analyzes them in order to identify potential vulnerabilities, the remote web application framework and other interesting information. Plugin type Grep Options This plugin doesnt have any user...

SOL14334 - BIG-IP Analytics generates predictable session cookies

Recommended action To mitigate this vulnerability, you can use an iRule to encrypt the BIG-IP Analytics session cookie sent to the client. To do so, perform the following procedure: Impact of procedure: Performing the following procedure should not have a negative impact on your system. 1. Log in...

CVE-2013-0510

IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test account by capturing these cookies...

CVE-2013-0510

IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test account by capturing these cookies...

CVE-2013-0510

CVE-2013-0510 affects IBM Security AppScan Enterprise 5.6 and 8.x prior to 8.7. A security test built into these versions sends session cookies to a specific external server, enabling MITM attackers to hijack the test account by capturing cookies. The description does not specify affected build d...

rubygem-rack: Timing attack in cookie sessions

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that doe...

TeamSHATTER Security Advisory: Oracle EM Cross Site Scripting in XDBResource cancelURL parameter (CVE-2013-0352)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TeamSHATTER Security Advisory Oracle Enterprise Manager Cross Site Scripting in XDBResource cancelURL parameter February 20, 2013 Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4; 10.2.0.5, 11.1.0.7,...

DEBIAN-CVE-2013-0263

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that doe...

Yahoo Mail Breach Linked to Old WordPress Vulnerability

Researchers at Australia-based BitDefender say they’ve found how some Yahoo Mail accounts are being hijacked, and it leads back to “buggy” blog software Yahoo’s developers used. For about a month Yahoo Mail account holders have been falling for a scam in which they click on a short link that...

CentOS Update for luci CESA-2013:0128 centos5

Check for the Version of luci OpenVAS Vulnerability Test CentOS Update for luci CESA-2013:0128 centos5 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

luci, ricci security update

CentOS Errata and Security Advisory CESA-2013:0128 Updated conga packages that fix one security issue, multiple bugs, and add two enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common...