5130 matches found
PT-2014-2307
Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.18.6 MediaWiki versions 1.19.x prior to 1.19.3 MediaWiki versions 1.20.x prior to 1.20.1 Description The issue allows remote attackers to hijack web sessions via the session id. This is related to a session fixati...
PT-2014-3411
Name of the Vulnerable Software and Affected Versions DataLife Engine DLE versions 9.7 and earlier Description A session fixation issue allows remote attackers to hijack web sessions via the PHPSESSID cookie. Recommendations For DataLife Engine DLE versions 9.7 and earlier, at the moment, there i...
CVE-2013-7387: Undefined Security Weakness
Session fixation vulnerability in DataLife Engine DLE 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie...
Session fixation
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...
Khan Academy: CRLF Injection
Is it possible for a remote attacker to inject custom HTTP headers. For example, an attacker can inject session cookies or HTML code. This may conduct to vulnerabilities like XSS cross-site scripting or session fixation. PoC...
Session fixation
debian/guest-account in Light Display Manager lightdm 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and...
tomcat: session fixation still possible with disableURLRewriting enabled
It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...
tomcat: session fixation still possible with disableURLRewriting enabled
It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...
CVE-2013-6994
OpenText Exceed OnDemand EoD 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by sniffing the network...
Session fixation
OpenText Exceed OnDemand EoD 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by sniffing the network...
CVE-2013-6994
CVE-2013-6994 affects OpenText Exceed OnDemand (EoD) 8. The issue is that the session ID is transmitted in cleartext, allowing remote attackers to perform session fixation by sniffing the network. The NVD entry documents a network-based attack with low attack complexity and no required authentica...
CVE-2013-6994: Undefined Security Weakness
OpenText Exceed OnDemand EoD 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by sniffing the network...
PT-2014-3244
Name of the Vulnerable Software and Affected Versions OpenText Exceed OnDemand EoD version 8 Description The issue allows remote attackers to perform session fixation attacks by sniffing the network, as the session ID is transmitted in cleartext. Recommendations For version 8, consider implementi...
Jasper Server 5.5 Session Fixation
Session Fixation / Hijacking on JasperServer + Date: 09/05/2014 + Risk: High + CWE number: CWE-384 + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.jaspersoft.com/ + Software Download : http://sourceforge.net/projects/jasperserver/ + Contact: [email protected] + Tested on:...
CVE-2014-0090
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...
Session fixation
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...
CVE-2014-0090
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...
CVE-2014-0090
Affected software : Foreman prior to 1.4.2 (affects Foreman-based stacks; linked Red Hat Satellite context may apply). Vulnerability : Session fixation via the session id cookie. Impact : Remote attackers can hijack web sessions. Root cause : Session identifier handling enables fixation attacks. ...
