2084 matches found
CVE-2017-12965
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2016-8745
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...
Muviko 1.0 SQL Injection
Exploit Title: Muviko - Video CMS v1.0 a 'q' Parameter SQL Injection Date: 02.08.2017 Vendor Homepage: https://muvikoscript.com/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview Muviko is a movie & video content manageme...
Session fixation
Session fixation vulnerability in Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id...
CVE-2015-1174
Session fixation vulnerability in Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id...
NfSen 1.3.7 / AlienVault OSSIM 4.3.1 customfnt Command Injection
Exploit Title: NfSen/AlienVault remote root exploit command injection in customfmt parameter Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault USM/OSSIM 4.3.1 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/...
NfSen 1.3.7 AlienVault OSSIM 4.3.1 - customfmt Command Injection
NfSen 1.3.7 AlienVault OSSIM 4.3.1 - customfmt Command Injection Exploit Title: NfSen/AlienVault remote root exploit command injection in customfmt parameter Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault USM/OSSIM 4.3.1...
NfSen < 1.3.7 / AlienVault OSSIM 4.3.1 - 'customfmt' Command Injection
Exploit Title: NfSen/AlienVault remote root exploit command injection in customfmt parameter Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault USM/OSSIM 4.3.1 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/...
NfSen 1.3.7 / AlienVault USM/OSSIM 5.3.4 Command Injection
Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/ Vendor Homepage:...
NfSen 1.3.7 AlienVault OSSIM 5.3.4 - Command Injection
NfSen 1.3.7 AlienVault OSSIM 5.3.4 - Command Injection Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage:...
Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak Vulnerability
The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected. Title: Barracuda WAF Management Application Username and Session ID Leak 1. Vulnerability Details Affected Vendor: Barracuda Affected Product: Web...
Barracuda WAF Management Application Username and Session ID Leak
Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded Linux CWE Classification: CWE-200: Information Exposure Impact: Privileged Access Attack vector: HTTP 2. Vulnerability Description The...
Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak
KL-001-2017-013 : Barracuda WAF Management Application Username and Session ID Leak Title: Barracuda WAF Management Application Username and Session ID Leak Advisory ID: KL-001-2017-013 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-013.tx...
PT-2017-2604
Name of the Vulnerable Software and Affected Versions U.motion Builder versions 1.2.1 and prior Description The issue is caused by the use of a hard-coded valid session ID in the system. This allows a remote attacker to bypass the authentication procedure by using a specially crafted user cookie...
Inflection: Session ID is accessible via XSS
Researcher found a vulnerability in the authentication flow that, when chained with an XSS vulnerability could lead to session take over...
(0Day) Schneider Electric U.motion Builder Embedded Session ID Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of session management. The application has a hard-code...
CVE-2017-8835
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a sessi...
Sunell IPCAMERA IPR54/14AKDN(II)/13 Session ID Enumeration
COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Sunell IPCAMERA IPR54/14AKDNII/13 1 Vendor: Shenzhen Sunell Technology Corporation CSNC ID: CSNC-2017-012 Subject: Session ID Enumeration Risk: High Effect: Remotely exploitable Author: Stephan Sekula Date:...
Sophos Web Appliance 4.3.1.1 - Session Fixation Vulnerability
Exploit for hardware platform in category web applications Exploit Title: Sophos Secure Web Appliance Session Fixation Vulnerability Date: 28/02/2017 Exploit Author: SlidingWindow , Twitter: @KapilKhot Vendor Homepage: https://www.sophos.com/en-us/products/secure-web-gateway.aspx Version: Tested ...
