1687 matches found
Sophos Web Appliance 4.3.1.1 - Session Fixation Vulnerability
Exploit for hardware platform in category web applications Exploit Title: Sophos Secure Web Appliance Session Fixation Vulnerability Date: 28/02/2017 Exploit Author: SlidingWindow , Twitter: @KapilKhot Vendor Homepage: https://www.sophos.com/en-us/products/secure-web-gateway.aspx Version: Tested ...
Replay Attack
github.com/v2ray/v2ray-core is vulnerable to replay attacks. The library doesn't implement session id's in its server, allowing a malicious user to send older packets to the server to establish a connection...
Weblate: session id missing secure flag - Hosted Website
Hey folks, Looks like the sessionid cookie handles session id but misses Secure flag. Cookies without this flag will transmitted over unencrypted channel and let's the man in the middle attackers to grab the value. Attack Vector - Attacker passes a http:// hosted website link - Victim clicks the...
CVE-2016-8924
IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...
Weblate: No expiration of session ID after Password change
If an user changes his password, the session persists and new session ID won't be created. POC - 1. Make any request and capture it using any proxy burp 2. Go to account settings and change the password. 3. Replay the captured request by changing any parameterusername or fullname 4. You get a...
Trend Micro Threat Discovery Appliance 2.6.1062r1 logoff.cgi Directory Traversal
!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance = 2.6.1062r1 logoff.cgi Directory Traversal Authentication Bypass Vulnerability Found by: Steven Seeley of Source Incite & Roberto Suggi Liverani - @malerisch - http://blog.malerisch.net/ File: TDAInstallationCD.2.6.1062r1.enUS.iso...
Trend Micro Threat Discovery Appliance - Session Generation Authentication Bypass (CVE-2016-8584)
In the last few months, I have been testing several Trend Micro products with Steven Seeley @steventseeley. Together, we have found more than 200+ RCE Remote Code Execution vulnerabilities and for the first time we presented the outcome of our research at Hack In The Box 2017 Amsterdam in April...
cURL -- TLS session resumption client cert bypass (again)
cURL security advisory: libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the...
Design/Logic Flaw
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293...
CVE-2017-1152
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293...
CVE-2014-9691
Huawei Tecal vulnerabilities CVE-2014-9691 affect multiple Tecal server models (e.g., RH1288 V2, RH2265 V2, RH2288 V2, RH5885 etc.) and variants listed in the Huawei advisory. The issue is an information disclosure via the web UI Online Users page, allowing logged-in users’ session IDs to be view...
CVE-2014-9692
CVE-2014-9692 affects Huawei Tecal servers (multiple models listed in the Intel/ROM update lines) with a vulnerability in RMCP+ session ID handling. The RMCP+ session IDs can be inferred, enabling an attacker to impersonate legitimate users and gain access with forged identities. Public reference...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
Cross site scripting
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2017-6971
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862...
CVE-2017-6971
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862...
Session fixation
Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...