CVE-2012-1248: Undefined Security Weakness

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CsForum v0.8 - Cross Site Scripting Vulnerability

Title: ====== CsForum v0.8 - Cross Site Scripting Vulnerability Date: ===== 2012-04-05 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=496 VL-ID: ===== 496 Introduction: ============= Forum very simple installation, this script is very light and yet it has several...

Microsoft Afkar Web Service - Cross Site Vulnerabilities

Document Title: =============== Microsoft Afkar Web Service - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=4797 MSRC ID: 12328nj Release Date: ============= 2012-04-13 Vulnerability Laboratory ID VL-ID:...

CVE-2012-1238: Undefined Security Weakness

Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2007-6752

Cross-site request forgery CSRF vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit...

CVE-2007-6752: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit...

PT-2012-1262 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions 7.12 and earlier Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the "user/logout" URI. The vendor disputes the...

JON: Unapproved agents can hijack an approved agent's endpoint by using a null security token

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token...

[SECURITY] [DSA 2423-1] movabletype-opensource security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2423-1 [email protected] http://www.debian.org/security/ Florian Weimer March 02, 2012 http://www.debian.org/security/faq -...

CVE-2012-0398: Undefined Security Weakness

EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via unspecified vectors...

Debian Security Advisory DSA 2423-1 (movabletype-opensource)

The remote host is missing an update to movabletype-opensource announced via advisory DSA 2423-1. OpenVAS Vulnerability Test $Id: deb24231.nasl 8970 2018-02-27 15:16:18Z cfischer $ Description: Auto-generated from advisory DSA 2423-1 movabletype-opensource Authors: Thomas Reinke Copyright:...

Debian: Security Advisory (DSA-2423-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2423-1 : movabletype-opensource - several vulnerabilities

Several vulnerabilities were discovered in Movable Type, a blogging system : Under certain circumstances, a user who has 'Create Entries' or'Manage Blog' permissions may be able to read known files on the local file system. The file management system contains shell command injection...

[SECURITY] [DSA 2423-1] movabletype-opensource security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2423-1 [email protected] http://www.debian.org/security/ Florian Weimer March 02, 2012 http://www.debian.org/security/faq -...

DSA-2423-1 movabletype-opensource - several

Bulletin has no description...

mod_cluster: malicious worker nodes can register on any vhost

modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from ...

mod_cluster: malicious worker nodes can register on any vhost

modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from ...

ExpressionEngine 2.2.2 / CodeIgniter 2.0.3 Cross Site Scripting

CVE: CVE-2011-4025 Vendor: EllisLab Products: ExpressionEngine 2.2.2, CodeIgniter 2.0.3 Vulnerabilities: xssclean filter bypass, leading to Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Reference: http://secureappdev.blogspot.com/2011/11/ellislab-xssclean-filter-bypass.html 1...

OCS Inventory NG 2.0.1 - Persistent Cross-Site Scripting

OCS Inventory NG 2.0.1 - Persistent XSS CVE-2011-4024 ------------------------------------------------------- Software : Open Computer and Software OCS Inventory NG Download : http://www.ocsinventory-ng.org/ Discovered by : Nicolas DEROUET nicolas.derouetgmailcom Discover : 2011-10-04 Published :...

OCS Inventory NG 2.0.1 Persistent XSS

Exploit for windows platform in category web applications OCS Inventory NG 2.0.1 - Persistent XSS CVE-2011-4024 ------------------------------------------------------- Software : Open Computer and Software OCS Inventory NG Download : http://www.ocsinventory-ng.org/ Discovered by : Nicolas DEROUET...