Pentaho BI Server Multiple Vulnerabilities

Pentaho BI Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier is affected by CVE-2009-5101 due to including the JSESSIONID in the URL. The session ID can be obtained from session history, Referer headers, or by sniffing web traffic, enabling an attacker to hijack a user session. The CVSS base score is 5.0 (Medium) wi...

PT-2011-1350

Name of the Vulnerable Software and Affected Versions Pentaho BI Server versions 1.7.0.1062 and earlier Description The issue allows attackers to obtain the session ID JSESSIONID from session history, referer headers, or by sniffing web traffic, as it is included in the URL. Recommendations For...

Google Web History vulnerable to new Firesheep Addon

Google Web History vulnerable to new Firesheep Addon Two researchers have shown how a modded version of the Firesheep Wi-Fi sniffing tool can be used to access most of a victim's Google Web History, a record of everything an individual has searched for. The core weakness discovered by the...

Google Web History vulnerable to new Firesheep Addon

Google Web History vulnerable to new Firesheep Addon Two researchers have shown how a modded version of the Firesheep Wi-Fi sniffing tool can be used to access most of a victim's Google Web History, a record of everything an individual has searched for. The core weakness discovered by the...

Oracle WebLogic Server Session Fixation (CVE-2010-4437)

A Remote attacker can exploit this vulnerability by enticing an unsuspecting user to first open a specially crafted web page and then log in to the target service. A session fixation vulnerability has been reported in Oracle WebLogic Server. This is a session fixation vulnerability. The...

phpMyAdmin3 (pma3) - Remote Code Execution

!/usr/bin/env python coding=utf-8 pma3 - phpMyAdmin3 remote code execute exploit Author: wofeiwo Thx Superhei Tested on: 3.1.1, 3.2.1, 3.4.3 CVE: CVE-2011-2505, CVE-2011-2506 Date: 2011-07-08 Have fun, DO NOT USE IT TO DO BAD THING. Requirements: 1. "config" directory must created&writeable in pm...

IF-CMS 2.07 - Local File Inclusion (Metasploit) (2)

IF-CMS 2.07 - Local File Inclusion Metasploit 2 $Id: if-cms.rb 2011-03-15 20:28:10 tecr0c $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...

CVE-2011-1788

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors...

Code injection

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors...

CVE-2011-1788

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors...

CVE-2011-1788

CVE-2011-1788 is discussed in VMware advisory VMSA-2011-0008 and related Nessus plugin; it covers SOAP session ID disclosure in vCenter Server as part of multiple VMware vulnerabilities. Connected documents also describe: (1) CVE-2011-0426 (directory traversal) affecting vCenter Server, VirtualCe...

PT-2011-3369

Name of the Vulnerable Software and Affected Versions vCenter Server versions 4.0 before Update 3 vCenter Server versions 4.1 before Update 1 Description The issue allows local users to discover the SOAP session ID via unspecified vectors. Recommendations For vCenter Server versions 4.0 before...

VMSA-2011-0008 : VMware vCenter Server and vSphere Client security vulnerabilities

a. vCenter Server Directory Traversal vulnerability A directory traversal vulnerability allows an attacker to remotely retrieve files from vCenter Server without authentication. In order to exploit this vulnerability, the attacker will need to have access to the network on which the vCenter Serve...

CVE-2011-1788: Exposure of Sensitive Information to an Unauthorized Actor

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors...

CVE-2011-1839

IBM Rational Build Forge 7.1.0 is vulnerable because it uses HTTP GET during redirection from the authentication servlet to a PHP script, enabling context-dependent attackers to discover session IDs by reading web-server access logs, Referer logs, or browser history. Affected component: the authe...

CVE-2011-1839: Exposure of Sensitive Information to an Unauthorized Actor

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

PT-2011-3401

Name of the Vulnerable Software and Affected Versions IBM Rational Build Forge version 7.1.0 Description The issue allows context-dependent attackers to discover session IDs by reading web-server access logs, web-server Referer logs, or the browser history. This is due to the use of the HTTP GET...