Multiple XSS Cross-Site Scripting Vulnerabilities in UFIDA ISM System

UFIDA ISM system is a new generation of enterprise IT service management products. Multiple XSS cross-site scripting vulnerabilities exist in UFIDA ISM System. It allows an attacker to insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking. Th...

Cisco IP Phone 8800 Series Cross-Site Scripting Vulnerability

The Cisco IP Phone 8800 Series is a telephony product that provides video and VoIP communication features. A cross-site scripting vulnerability exists in the Cisco IP Phone 8800 Series, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can b...

IBM Lotus Protector for Mail Security Cross-Site Scripting Vulnerability

IBM Lotus Protector for Mail Security is a suite of email content filtering solutions for IBM Lotus Notes, IBM Lotus Domino, Microsoft Exchange and hybrid email environments. A cross-site scripting vulnerability exists in IBM Lotus Protector for Mail Security, which allows remote attackers to...

DEBIAN-CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

CVE-2016-5696

net/ipv4/tcpinput.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack...

DEBIAN-CVE-2016-5696

net/ipv4/tcpinput.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack...

CVE-2016-1607

Multiple cross-site request forgery CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request...

Collectd-web 'ajax_post.php' cross-site scripting vulnerability

Collectd-web is a set of web-based front-end tools for collectd to collect RRD data. Collectd-web suffers from a cross-site scripting vulnerability that allows remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

BitTorrent Cross-Site Scripting Vulnerability

BitTorrent is a set of peer-to-peer file uploading and downloading software based on the BitTorrent protocol. BitTorrent suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain...

Drupal Fieldable Panels Panes (FPP) Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal Fieldable Panels Panes FPP, which allows remote attackers to exploit the vulnerability to inject malicious script or...

CVE-2016-0340

IBM Security Identity Manager ISIM Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

CVE-2016-0340

IBM Security Identity Manager ISIM Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

IBM Forms Server Cross-Site Scripting Vulnerability

IBM Forms Server is the United States IBM's set of scalable document-based form application of electronic form automation software. A cross-site scripting vulnerability exists in IBM Forms Server that stems from the program's failure to adequately filter user-submitted input. An attacker could...

CVE-2016-2889

Cross-site request forgery CSRF vulnerability in the Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrar...

CVE-2016-0315

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

Design/Logic Flaw

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

CVE-2016-0315

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

IBM Jazz Reporting Service (JRS) Session Hijacking Vulnerability

IBM Jazz Reporting Service is an optional component of IBM Rational Reporting for Development Intelligence. IBM Jazz Reporting Service JRS has a security vulnerability in the Report Builder and Data Collection Component DCC implementations due to the program retaining session ID validity after...

USN-3024-1 tomcat6, tomcat7 vulnerabilities

It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote attacker could use this issue to possibly list a parent directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu...

Symphony CMS Session Fixation Vulnerability

Symphony CMS is a content management system developed in PHP and MySQL. A session fixation vulnerability exists in Symphony CMS when session.useonlycookies is enabled in the program, which can be exploited by a remote attacker to hijack a web session by submitting the PHPSESSID parameter...