CVE-2014-9386: Undefined Security Weakness

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...

CVE-2014-3684

The tmadopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager aka TORQUE Resource Manager 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary...

PT-2014-5532

Name of the Vulnerable Software and Affected Versions Centreon versions 2.5.1 through 2.5.2 Centreon Enterprise Server version 2.2 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the session id or template id parameter, related to the comman...

PT-2014-5531

Name of the Vulnerable Software and Affected Versions Centreon versions 2.5.1 through 2.5.2 Centreon Enterprise Server version 2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the index id parameter to...

Session ID URL's in logfile

Hi, In the logfiles you can see the session ID's in the URL. Can this be used to hack into a another account?...

Session ID URL's in logfile

Hi, In the logfiles you can see the session ID's in the URL. Can this be used to hack into a another account?...

Supermicro Onboard IPMI Port 49152 敏感文件泄露漏洞

关于 IPMI：智能平台管理接口 IPMI 是一种开放标准的硬件管理接口规格，定义了嵌入式管理子系统进行通信的特定方法。IPMI 信息通过基板管理控制器 BMC（位于 IPMI 规格的硬件组件上）进行交流。IPMI是智能型平台管理接口（Intelligent Platform Management Interface）的缩写，是管理基于...

CVE-2014-0153

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page...

PT-2014-3505 · Ovirt · Ovirt

Name of the Vulnerable Software and Affected Versions: oVirt versions 3.4.0 and earlier Description: The issue concerns the REST API in oVirt, where session IDs are stored in HTML5 local storage. This allows remote attackers to obtain sensitive information via a crafted web page. Recommendations:...

Huawei VP9610 / 9620 Fixed Session ID (HWNSIRT-2013-0318)

The remote host is a Huawei switch running a firmware version that is affected by a fixed session ID vulnerability. A remote, unauthenticated attacker can exploit this to spoof a legitimate user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CS-Cart 4.2.0 Session Hijacking Vulnerability

CS-Cart version 4.2.0 suffers from a session hijacking vulnerability due to weakly minted session identifiers. Vendor: CS-Cart Homepage: https://www.cs-cart.com Fixed in: v4.2.1 Released: July 22nd 2014 CS-Cart is 127MB of shitty PHP and HTML code that is supposed to function as a secure e-commer...

Oxwall 1.7.0 - Remote Code Execution Exploit

Oxwall suffers from an authenticated arbitrary PHP code execution. The vulnerability is caused due to the improper verification of uploaded files in '/admin/settings/user' script thru the 'avatar' and 'bigAvatar' POST parameters. This can be exploited to execute arbitrary PHP code by uploading a...

Oracle Linux 7 : gnutls (ELSA-2014-0684)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0684 advisory. 3.1.18-9 - fix session ID length check 1102027 - fixes null pointer dereference 1101727 Tenable has extracted the preceding description block directly...

gnutls security update

3.1.18-9 - fix session ID length check 1102027 - fixes null pointer dereference 1101727...

VMware ESX 2.x Multiple Information Disclosure Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/19249/info VMware ESX is prone to multiple information-disclosure vulnerabilities. These issues are due to a design error in the application. The following issues were reported: 1. An information disclosure vulnerability...

runcms 1.6 - Multiple Vulnerabilities

No description provided by source. Digital Security Research Group Advisory Application: RunCMS Versions Affected: RunCMS 1.6 Vendor URL: http://www.runcms.org Bugs: SQL Injections, XSS, PHP Include, Predictable session id, etc. Exploits: Aviable Reported: 14.12.2007 Vendor response: 15.12.2007...

fresh email script 1.0 - Multiple Vulnerabilities

No description provided by source. 1. +-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation 5. +-----------------founde...

Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4...

Webmin 0.9x,Usermin 0.9x/1.0 Session ID Spoofing Unauthenticated Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6915/info A vulnerability has been discovered in the 'Miniserv.pl' script used to invoke both Webmin and Usermin. Due to insufficient sanitization of client-supplied BASE64 encoded input, it is possible to inject a Sessio...

Hesk 0.92/0.93 Session ID Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14879/info Hesk is prone to an authentication bypass vulnerability. Successful exploitation will grant an attacker administrative access to the application. This can lead to unauthorized access of sensitive data,...