1778 matches found
CVE-2013-6994
OpenText Exceed OnDemand EoD 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by sniffing the network...
CVE-2013-6994
OpenText Exceed OnDemand EoD 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by sniffing the network...
CVE-2013-6994
CVE-2013-6994 affects OpenText Exceed OnDemand (EoD) 8. The issue is that the session ID is transmitted in cleartext, allowing remote attackers to perform session fixation by sniffing the network. The NVD entry documents a network-based attack with low attack complexity and no required authentica...
CVE-2014-0090
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...
Session fixation
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...
Syhunt Advisory: CGILua session.lua Predictable Session ID Vulnerability
Syhunt Advisory: CGILua session.lua Predictable Session ID Vulnerability Advisory-ID: 201404301 Discovery Date: 03.27.2014 Release Date: 04.30.2014 Affected Applications: CGILua 5.0.x, CGILua 5.1.x., CGILua 5.2 alpha 1 & CGILua 5.2 alpha 2 Class: Predictable Session ID Status: Unpatched/Vendor...
AlienVault OSSIM SQL Injection and Remote Code Execution
This module exploits an unauthenticated SQL injection vulnerability affecting AlienVault OSSIM versions 4.3.1 and lower. The SQL injection issue can be abused in order to retrieve an active admin session ID. If an administrator level user is identified, remote code execution can be gained by...
MODx Blind SQL Injection Vulnerability
MODx versions prior to 2.2.14 suffer from multiple remote blind SQL injection vulnerabilities. Product description: ============ MODX originally MODx is a free, open source content management system and web application framework for publishing content on the world wide web and intranets...
MODx Blind SQL Injection
Product description: ============ MODX originally MODx is a free, open source content management system and web application framework for publishing content on the world wide web and intranets. ============ MODX Revolution Blind SQL Injection CVE-2014-2736 ============ The application is vulnerab...
Ensnare Web Application Attack Detection Utility Released
BOSTON – Two engineers from Netflix this week released to open source a security tool that detects attacks against web applications—and also reacts to those attacks with responses they hope will flummox a hacker to the point that he moves on to his next target. The utility is called Ensnare and i...
Debian DSA-2891-1 : mediawiki, mediawiki-extensions Multiple Vulnerabilities
The remote Debian host is missing a security update. It is, therefore, affected by multiple vulnerabilities in MediaWiki : - A cross-site scripting XSS vulnerability exists due to a failure to validate input before returning it to the user. An unauthenticated, remote attacker can exploit this, vi...
ChatNess 2.5 Session Fixation
Exploit Title: ChatNess 2.5 Session Fixation Script Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://www.chatness.us Version : 2.5 Tested on: Windows Category: webapps Google Dork: intext:"Powered by Chatness" + Exploit : http:///chatness/chatness/chat.php Discovered by: Scripting...
Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : tomcat6, tomcat7 vulnerabilities (USN-2130-1)
It was discovered that Tomcat incorrectly handled certain inconsistent HTTP headers. A remote attacker could possibly use this flaw to conduct request smuggling attacks. CVE-2013-4286 It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A...
CVE-2013-6925
The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id value...
WatchGuard Firewall XTM 11.7.4u1 - Remote Buffer Overflow
Exploit for hardware platform in category remote exploits !/usr/bin/perl -w Exploit Title: WatchGuard Firewall XTM version 11.7.4u1 - Remote buffer overflow exploit sessionid cookie Date: Oct 18 2013 Exploit Author: email protected a.k.a. email protected Vendor Homepage: http://www.watchguard.com...
Design/Logic Flaw
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id 1 via a man-in-the-middle attack ...
CVE-2012-4529
CVE-2012-4529 affects Red Hat JBoss Web 7.1.x and earlier when COOKIE session tracking is used, where org.apache.catalina.connector.Response.encodeURL() may append jsessionid to the first response URL, enabling session hijacking via MITM or log exposure. Connected advisories indicate Red Hat JBos...
Shopex background of the login page injection vulnerability attached to the use of POC-vulnerability warning-the black bar safety net
To login when passed a certain parameter does not do the filter, resulting in the injection of the generated Recently made secondary development of the time saw the login process 发现 在 文件 \shopex\core\admin\controller\ctl.passport.php Processing the verification code, The management account and...
ZeroShell 'cgi-bin/kerbynet' - Local File Disclosure
Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named "kerbynet" interpreted in cgi-bin directory here : /cdrom/usr/local/apache2/cgi-bin/kerbynet So all url look like this :...
