2450 matches found
Debian Security Advisory DSA 3075-1 (drupal7 - security update)
Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2014-9015 Aaron Averill discovered that a specially crafted request can give a user access to another user OpenVAS...
USN-2347-1 python-django vulnerabilities
Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...
Code injection
The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...
CVE-2014-4756
The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...
PT-2014-6098
Name of the Vulnerable Software and Affected Versions IBM Rational License Key Server versions 8.1.4.x before 8.1.4.4 Description The issue in the Administration and Reporting Tool allows remote authenticated users to hijack sessions. Recommendations For IBM Rational License Key Server versions...
GLSA-201408-11 : PHP: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201408-11 PHP: Multiple vulnerabilities Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker can cause arbitrary code execution...
PHP: Multiple vulnerabilities
Background PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Description Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact A...
Poor Crypto on Instagram Mobile Apps Allow Man-in-the-Middle
Two unrelated researchers this week disclosed a similar session hijack bug in the Instagram mobile applications for Android and iOS. Facebook has reportedly acknowledged the problem, which arose from a failure to fully encrypt all data traffic on the service, but the world’s largest social networ...
CVE-2014-3552
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...
Authentication flaw
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...
CVE-2014-3552
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...
PT-2014-5390
Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.3.11 Moodle versions 2.4.x prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.7 Description The issue concerns the Shibboleth authentication plugin in Moodle, which fails to check if a session ID is empty. This allow...
PT-2014-6057
Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description A session fixation issue allows remote attackers to hijack web sessions via a firewall login cookie. Recommendations For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue...
CVE-2014-2509: Undefined Security Weakness
Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...
CuteNews 1.4.6 editnews Module doeditnews Action Admin Moderation Bypass
No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...
Fire Soft Board <= 2.0.1 Persistent XSS Vulnerability (admin panel)
No description provided by source. Exploit Title: Fire Soft Board = 2.0.1 Persistent XSS Vulnerability admin panel Date: 2011-07-11 Author: jill for A-S Software Link: http://www.fire-soft-board.com/index.php?p=download&mode=cat&id=2 Version: 2.0.1 There is a vulnerability on Fire Soft Board foru...
Lunar CMS 3.3 - CSRF And Stored XSS Vulnerability
No description provided by source. ?!-- Lunar CMS 3.3 CSRF And Stored XSS Vulnerability Vendor: Lunar CMS Product web page: http://www.lunarcms.com Affected version: 3.3 Summary: Lunar CMS is a freely distributable open sourcecontent management system written for use on servers running the ever s...
OCS Inventory NG 2.0.1 Persistent XSS
No description provided by source. OCS Inventory NG 2.0.1 - Persistent XSS CVE-2011-4024 ------------------------------------------------------- Software : Open Computer and Software OCS Inventory NG Download : http://www.ocsinventory-ng.org/ Discovered by : Nicolas DEROUET nicolas.derouetgmailco...
Elxis CMS 2008.1 modules/mod_language.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/31764/info Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation...
Design/Logic Flaw
IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to hijack sessions, and consequently read records, modify records, or conduct transactions, via an unspecified link injection...