TurboMail <=6.0.0 /mailmain 跨站脚本漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 import re import random from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '1709' vul ID version = '1' author = 'lixin' vulDate = '2014-05-15'...

Insufficiently random session id in Java SockJS client

Session id generation in the Java SockJS client is not sufficiently secure and could allow a user to send messages to another user’s session. Note that this only affects users of the Java SockJS client, which generates its own session id. It does not affect browser clients even if they’re...

ownCloud Multiple Vulnerabilities -01 (Feb 2015)

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

CVE-2014-0154

CVE-2014-0154 affects oVirt Engine before 3.5.0. The vulnerability stems from not setting the HttpOnly flag in the Set-Cookie header for session IDs, enabling potential script access to the cookie and remote session hijacking if an attacker can reach the user’s browser. Public documents confirm t...

PT-2015-08: Bypass Anti-Bruteforce Mechanism in Inductive Automation Ignition

The specialists of the Positive Research center have detected a Bypass Anti-Bruteforce Mechanism vulnerability in Inductive Automation Ignition. The mechanism of blocking bruteforce attacks could be bypassed with resetting session id parameter in HTTP request. The mechanism blocking bruteforce...

PT-2015-4143

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.x through 6.0.5 ownCloud Server versions 7.x through 7.0.2 Description The issue in the documents application allows remote authenticated users to obtain all valid session IDs via an unspecified API method...

CVE-2014-9049: Exposure of Sensitive Information to an Unauthorized Actor

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method...

Facebook BBP - Session ID & CSRF Vulnerability

Document Title: =============== Facebook BBP - Session ID & CSRF Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1433 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1432 Vulnerability Magazin...

Facebook BBP #23 - Session ID & CSRF Vulnerability

Document Title: =============== Facebook BBP 23 - Session ID & CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1432 Facebook Security ID: 10202805822321483 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Vulnerability Magazine:...

Facebook BBP #23 - Session ID & CSRF Vulnerability

Document Title: =============== Facebook BBP 23 - Session ID & CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1432 Facebook Security ID: 10202805822321483 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Vulnerability Magazine:...

Facebook BBP - Session ID & CSRF Vulnerability

Document Title: =============== Facebook BBP - Session ID & CSRF Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1433 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1432 Vulnerability Magazin...

CVE-2 0 1 4-8 2 7 2 vulnerability analysis: Dell Remote Control Card vulnerability in the Session-ID mechanism-vulnerability warning-the black bar safety net

! We recently found a Dell integrated Remote Control CardiDRACthe vulnerability, Dell integrated remote control card is integrated in the server on small devices. Hackers use this number for theCVE-2 0 1 4-8 2 7 2 vulnerabilities inlow permissions or not the authentication of the case, to enable ...

Oracle Solaris Third-Party Patch Update : tomcat (multiple_vulnerabilities_in_apache_tomcat3)

The remote Solaris system is missing necessary patches to address security updates : - java/org/apache/coyote/http11/InternalNioInputBuffer.jav a in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows...

Dell iDRAC IPMI 1.5 Insufficient Session ID Randomness

""" For testing purposes only. c Yong Chuan, Koh 2014 """ from time import sleep from socket import from struct import from random import import sys, os, argparse HOST = None PORT = 623 bufsize = 1024 recv = "" create socket UDPsock = socketAFINET,SOCKDGRAM UDPsock.settimeout2 data = 21 offset of...

Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness

Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness """ For testing purposes only. c Yong Chuan, Koh 2014 """ from time import sleep from socket import from struct import from random import import sys, os, argparse HOST = None PORT = 623 bufsize = 1024 recv = "" create socket UDPsock =...

Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness

""" For testing purposes only. c Yong Chuan, Koh 2014 """ from time import sleep from socket import from struct import from random import import sys, os, argparse HOST = None PORT = 623 bufsize = 1024 recv = "" create socket UDPsock = socketAFINET,SOCKDGRAM UDPsock.settimeout2 data = 21 offset of...

Security Advisory-Multiple Vulnerabilities on Huawei Tecal

Some Huawei server products have multiple security vulnerabilities. 1.Some Huawei server products have the sensitive information leak vulnerability. Users who log in to the products can view the sessions IDs of all online users on the Online Users page of the web UI. Attackers can also view the...

CVE-2014-8272

CVE-2014-8272 affects Dell iDRAC6 (modular before 3.65; monolithic before 1.98) and iDRAC7 before 1.57.57, where IPMI 1.5 session ID values are not properly randomized or selected, enabling remote attackers to brute-force session IDs and execute arbitrary commands. The vulnerability is remote (ne...

CVE-2014-8272: Undefined Security Weakness

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack...

PT-2014-8978

Name of the Vulnerable Software and Affected Versions Zenoss Core versions prior to 4.2.5 SP161 Description The issue allows remote attackers to hijack sessions by leveraging an unattended workstation, as the session ID cookie has an infinite lifetime. Recommendations For versions prior to 4.2.5...