Updated rt/perl-Encode packages fix security vulnerability

RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket CVE-2012-4733. RT 3.8.0 and above include a version of bin/rt th...

Digium Asterisk Open Source and Certified Asterisk Session Hijacking Vulnerability

Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. A security vulnerability exists in Asterisk...

Session Hijacking Bug Exposed GitLab Users Private Tokens

GitLab, the popular web-based Git repository manager, fixed a vulnerability recently that could have exposed its users to session hijacking attacks. Daniel Svartman, a security researcher with Imperva, discovered the issue in May but couldn’t disclose it until Wednesday, after GitLab was able to...

Siemens Fixes Session Hijacking Bug in LOGO!, Warns of Man-in-the-Middle Attacks

Administrators who have Siemens’ LOGO! logic module deployed in automation setups are being urged to update its firmware. The German industrial manufacturing giant pushed out an update for its LOGO! 8 BM devices Wednesday morning to fix a vulnerability CVE-2017-12734 that could let an attacker...

Siemens LOGO! (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! Vulnerabilities: Insufficiently Protected Credentials, Man-in-the-Middle 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

rest-client session fixation vulnerability

The rest-client aka REST Client is one of those simple HTTP and REST clients. A session fixation vulnerability exists in rest-client. An attacker can exploit this vulnerability to hijack a session or gain access to sensitive information...

Cisco Integrated Management Controller User Session Hijacking Vulnerability

According to its self-reported version, the Cisco Unified Computing System Management Software is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

Synology Photo Station Unauthenticated Remote Code Execution

Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo...

Unikrn: ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com)

Summary: Vulnerabilities in OpenSSH Session Hijacking Vulnerability is a Medium risk vulnerability that is one of the most frequently found on networks around the world. This issue has been around since at least 1990 but has proven either difficult to detect, difficult to resolve or prone to bein...

Unit4 Polska TETA Web Session Fixation Vulnerability

Unit4 Polska TETA Web formerly known as TETA Galactica is a package of solutions including personnel, financial and logistics management systems from Unit4 Poland. A session fixation vulnerability exists in Unit4 Polska TETA Web 22.62.3.4 and earlier versions. A remote attacker can exploit the...

RedHat Update for X.org X11 libraries RHSA-2017:1865-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco Adaptive Security Appliance Cross-Site Scripting Vulnerability (CNVD-2017-20380)

The Cisco Adaptive Security Appliance is a set of firewall appliances from the American company Cisco. A cross-site scripting vulnerability exists in the Cisco Adaptive Security Appliance WEB management script, which allows remote attackers to exploit the vulnerability to inject malicious script ...

CVE-2016-9981

IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257...

libICE: weak entropy usage in session keys

It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list...

Moderate: Red Hat Security Advisory: X.org X11 libraries security, bug fix and enhancement update

An update is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links ...

CookieCatcher - Tool to assist in the exploitation of XSS

CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used without proper...

OpenProject Session Hijacking Vulnerability

OpenProject is an open source Web-based project management software . The software has project planning , task management , bug tracking and cost budgeting and other functions . A session hijacking vulnerability exists in OpenProject versions prior to 6.1.6 and 7.x versions prior to 7.0.3, which...

FreeIPA 2.213 Session Hijacking

Description An attacker can hijack the session to unlock the users when they has been locked with his last sesiA3n. ===================================================================== Session hijacking This type of attack involves an adversary that exploits weaknesses in an application's use of...

CVE-2017-11667

OpenProject is affected before 6.1.6 and 7.x before 7.0.3. The root cause is mishandling of session expiry, enabling remote attackers to perform APIv3 requests indefinitely via a hijacked session. Remediation: upgrade to OpenProject 6.1.6 or 7.0.3 or later, where the security fixes were released....

Ektron Content Management System Cross-Site Scripting Vulnerability

Ektron Content Management System is an enterprise-level Web content management system from Ektron, Inc. A cross-site scripting vulnerability exists in the Ektron Content Management System, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtai...