CVE-2013-6309

CVE-2013-6309 affects IBM Marketing Platform 9.1 before FP2. The vulnerability allows remote authenticated users to hijack sessions and thereby read/modify records or conduct transactions via an unspecified link injection. Public sources in the connected documents corroborate the affected product...

PT-2014-3082

Name of the Vulnerable Software and Affected Versions IBM Marketing Platform version 9.1 before FP2 Description The issue allows remote authenticated users to hijack sessions via an unspecified link injection, which can lead to reading records, modifying records, or conducting transactions...

Lunar CMS 3.3 CSRF / Cross Site Scripting

CSRF Add Admin =============== input type="hidden" name="email" v...

Lunar CMS 3.3 - Cross-Site Request Forgery Persistent Cross-Site Scripting

Lunar CMS 3.3 - Cross-Site Request Forgery Persistent Cross-Site Scripting CSRF Add Admin =============== input type="hidden" name="name" value="Hacker"...

Lunar CMS 3.3 - Cross-Site Request Forgery / Persistent Cross-Site Scripting

CSRF Add Admin ===============...

Samsung Cross Site Scripting

Advisory: design.samsung.com– Cross-Site Script Vulnerability XSS Advisory ID: 03062014 Author: Roberto Garcia @1gbDeInfo Affected Software: Successfully tested on design.samsung.com Vendor URL: http://www.design.samsung.com Vendor Status: informed and solved Vulnerability Description The website...

DEBIAN-CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

CVE-2012-5395: Undefined Security Weakness

Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauthSession cookie...

CVE-2013-7387: Undefined Security Weakness

Session fixation vulnerability in DataLife Engine DLE 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie...

PT-2014-2308

Name of the Vulnerable Software and Affected Versions MediaWiki CentralAuth extension versions prior to 1.18.6 MediaWiki CentralAuth extension versions 1.19.x prior to 1.19.3 MediaWiki CentralAuth extension versions 1.20.x prior to 1.20.1 Description The issue allows remote attackers to hijack we...

PT-2014-3411

Name of the Vulnerable Software and Affected Versions DataLife Engine DLE versions 9.7 and earlier Description A session fixation issue allows remote attackers to hijack web sessions via the PHPSESSID cookie. Recommendations For DataLife Engine DLE versions 9.7 and earlier, at the moment, there i...

tomcat: session fixation still possible with disableURLRewriting enabled

It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...

tomcat: session fixation still possible with disableURLRewriting enabled

It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...

PT-2014-3538

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.10, 2.5.x before 2.5.6, 2.6.x before 2.6.3 Description The issue allows remote attackers to hijack sessions via a brute-force attack because login/token.php creates a MoodleMobile web-servic...

CVE-2014-0090

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...

PT-2014-3474 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.4.2 Description: The issue allows remote attackers to hijack web sessions. This is achieved via the session id cookie. Recommendations: For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the...

UBUNTU-CVE-2014-2327

Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...

CVE-2014-2341: Improper Authentication

Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter...

CVE-2014-1984: Improper Authentication

Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors...

Targeted Attack Uses Heartbleed to Hijack VPN Sessions

A targeted attack against an unnamed organization exploited the Heartbleed OpenSSL vulnerability to hijack web sessions conducted over a virtual private network connection. Incident response and forensics firm Mandiant shared some details on a recent investigation of an incident that began April ...