Session fixation

Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privileges via a brute force session hijacking attack...

CVE-2014-8496

Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privileges via a brute force session hijacking attack...

CVE-2014-8496

This CVE affects Digicom DG-5514T ADSL router with firmware 3.2, where predictable session IDs enable remote attackers to gain administrator privileges via a brute-force session hijacking attack. The connected documents confirm the vulnerability and impact but do not provide any remediation or pa...

ACLs not properly enforced in "documents" application - ownCloud

The "documents" application is a collaborative web-based online editor for ODT files. Using this application you can easily share and collaborate on office documents. This application uses strong and very long random "Session IDs" to limit access to specific resources. Knowledge of this ID allows...

Server: ACLs not properly enforced in "documents" application

The "documents" application is a collaborative web-based online editor for ODT files. Using this application you can easily share and collaborate on office documents. This application uses strong and very long random "Session IDs" to limit access to specific resources. Knowledge of this ID allows...

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

Design/Logic Flaw

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

Cross site request forgery (csrf)

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page...

CVE-2014-0153

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page...

CVE-2014-0153

CVE-2014-0153 affects oVirt REST API prior to the 3.4.1/3.4.x updates, where session IDs are stored in HTML5 local storage. The underlying risk is that an attacker could read a user’s session ID from local storage via a crafted web page, leading to potential confidentiality impact. Affected softw...

Tridium Niagara AX Web Server < 3.5.40.3 / 3.6 < 3.6.47.3 Multiple Vulnerabilities

Binary data 8348.prm...

Debian DSA-2944-1 : gnutls26 - security update

Joonas Kuorilehto discovered that GNU TLS performed insufficient validation of session IDs during TLS/SSL handshakes. A malicious server could use this to execute arbitrary code or perform denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

gnutls26 security update

Package : gnutls26 Version : 2.8.6-1+squeeze4 CVE ID : CVE-2014-3466 Joonas Kuorilehto discovered that GNU TLS performed insufficient validation of session IDs during TLS/SSL handshakes. A malicious server could use this to execute arbitrary code or perform denial or service...

DLA-0001-1 gnutls26 - security update

Bulletin has no description...

DSA-2944-1 gnutls26 - security update

Bulletin has no description...

Debian: Security Advisory (DSA-2944-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM Patches Predictable Output Problem in SecureRandom PRNG

Details have surfaced on a recently patched vulnerability in IBM’s SecureRandom pseudo-random number generator that could allow an attacker to predict its output. Only the default SecureRandom implementation in the IBM Java Cryptography Extension JCE framework is vulnerable; IBM recommends that...

MediaWiki < 1.19.9 / 1.20.8 / 1.21.3 Multiple Vulnerabilities

According to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities : - Input validation errors exist that allow cross-site scripting attacks. CVE-2013-4567, CVE-2013-4568 - An error exists related to session IDs and HTTP headers that...

CVE-2013-0539

An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for remote attackers to hijack sessions, and consequently obtain sensitive information, via a brute-force attack...