CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

Apache2Triad Session Fixation Vulnerability

Apache2Triad is a server software deployment solution for Windows-based platforms. A session fixation vulnerability exists in Apache2Triad version 1.5.4. A remote attacker can exploit this vulnerability to hijack a web session with the help of the 'PHPSESSID' parameter...

F5 Networks BIG-IP Edge Client: session ID vulnerability (K06635145)

The version of the Big-IP Edge Client installed on the remote Windows host is in the range 7071.x through 7132.x. It is, therefore, affected by a flaw in the BIG-IP Edge Client that exposes the current session ID as part of the request URI when sending Keep-Alive requests over an SSL channel. Thi...

CVE-2017-12965

Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter...

CVE-2016-8745

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...

Muviko 1.0 SQL Injection

Exploit Title: Muviko - Video CMS v1.0 a 'q' Parameter SQL Injection Date: 02.08.2017 Vendor Homepage: https://muvikoscript.com/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview Muviko is a movie & video content manageme...

Session fixation

Session fixation vulnerability in Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id...

CVE-2015-1174

Session fixation vulnerability in Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id...

NfSen 1.3.7 AlienVault OSSIM 4.3.1 - customfmt Command Injection

NfSen 1.3.7 AlienVault OSSIM 4.3.1 - customfmt Command Injection Exploit Title: NfSen/AlienVault remote root exploit command injection in customfmt parameter Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault USM/OSSIM 4.3.1...

NfSen 1.3.7 / AlienVault OSSIM 4.3.1 customfnt Command Injection

Exploit Title: NfSen/AlienVault remote root exploit command injection in customfmt parameter Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault USM/OSSIM 4.3.1 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/...

NfSen < 1.3.7 / AlienVault OSSIM 4.3.1 - 'customfmt' Command Injection

Exploit Title: NfSen/AlienVault remote root exploit command injection in customfmt parameter Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault USM/OSSIM 4.3.1 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/...

NfSen 1.3.7 / AlienVault USM/OSSIM 5.3.4 Command Injection

Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/ Vendor Homepage:...

NfSen 1.3.7 AlienVault OSSIM 5.3.4 - Command Injection

NfSen 1.3.7 AlienVault OSSIM 5.3.4 - Command Injection Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage:...

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak Vulnerability

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected. Title: Barracuda WAF Management Application Username and Session ID Leak 1. Vulnerability Details Affected Vendor: Barracuda Affected Product: Web...

Barracuda WAF Management Application Username and Session ID Leak

Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded Linux CWE Classification: CWE-200: Information Exposure Impact: Privileged Access Attack vector: HTTP 2. Vulnerability Description The...

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak

KL-001-2017-013 : Barracuda WAF Management Application Username and Session ID Leak Title: Barracuda WAF Management Application Username and Session ID Leak Advisory ID: KL-001-2017-013 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-013.tx...

Inflection: Session ID is accessible via XSS

Researcher found a vulnerability in the authentication flow that, when chained with an XSS vulnerability could lead to session take over...

(0Day) Schneider Electric U.motion Builder Embedded Session ID Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of session management. The application has a hard-code...

CVE-2017-8835

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a sessi...

Sunell IPCAMERA IPR54/14AKDN(II)/13 Session ID Enumeration

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Sunell IPCAMERA IPR54/14AKDNII/13 1 Vendor: Shenzhen Sunell Technology Corporation CSNC ID: CSNC-2017-012 Subject: Session ID Enumeration Risk: High Effect: Remotely exploitable Author: Stephan Sekula Date:...