OWOX, Inc.: Broken Authentication & Session Management (Login Bypass) at support.owox.com

Hello Team, While I was testing your Web Application OWOX, I came to know that https://support.owox.com/ is Vulnerable to "Broken Authentication & Session Management Vulnerability" and it is possible to bypass the login very easily. When the user login with his credentials via gmail account, he...

CVE-2016-4896

SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via unspecified vectors...

Information disclosure

SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via unspecified vectors...

CVE-2016-1178

The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via unspecified vectors...

CVE-2016-1178

The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via unspecified vectors...

CVE-2016-1178

The CVE-2016-1178 issue affects appleple a-blog cms up to version 2.6.0.1, where a flaw in the session management of the comment feature allows remote attackers to obtain or modify sensitive data. Related sources describe concrete impacts: an unauthenticated attacker could delete arbitrary commen...

CVE-2016-4896

SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via unspecified vectors...

CVE-2016-4896

CVE-2016-4896 affects SetucoCMS (all versions) due to improper session management. The vulnerability can permit a remote attacker to disclose or alter information through unspecified vectors. The JVN/NVD entries corroborate a session-management issue with a low to moderate risk profile (CVSS v3 b...

CVE-2016-1178

The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via unspecified vectors...

Github Enterprise Default Session Secret And Deserialization

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Github Enterprise Default Session Secret And Deserialization Vulnerability", 'Description' = %q This module exploits two securi...

AXIS Communications Cross Site Request Forgery

0RWELLL4BS security advisory olsa-CVE-2015-8255 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: Cross-Site Request Forgery - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Session Management control CWE-352 - CVE Name: CVE-2015-8255 - Affecte...

AXIS (Multiple Products) - Cross-Site Request Forgery

AXIS Multiple Products - Cross-Site Request Forgery 0RWELLL4BS security advisory olsa-CVE-2015-8255 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: Cross-Site Request Forgery - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Session Management...

AXIS Communications Cross Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Advisory Information ==================== - Title: Cross-Site Request Forgery - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Session Management control CWE-352 - CVE Name: CVE-2015-8255 - Affected Versions: - I...

AXIS (Multiple Products) - Cross-Site Request Forgery

0RWELLL4BS security advisory olsa-CVE-2015-8255 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: Cross-Site Request Forgery - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Session Management control CWE-352 - CVE Name: CVE-2015-8255 - Affecte...

New Relic: Broken Authentication and session management OWASP A2

@honc reported an issue with session expiration. We determined that this report was invalid, and it was self-closed by the researcher. Insufficient Session Expiration vulnerability...

PostfixAdmin Session Management Security Bypass Vulnerability

PostfixAdmin is a web-based administration tool for Postfix mail delivery servers. A security bypass vulnerability exists in PostfixAdmin. An attacker could use this vulnerability to bypass security restrictions to obtain sensitive information or perform unauthorized operations to launch further...

CVE-2016-4027

Open-Xchange OX App Suite (frontend) prior to 7.8.1-rev10 contains an information disclosure vulnerability where a user-controlled cookie-storage setting was misapplied during non-interactive logins. Cookies with authentication information could be stored and become accessible to other users on s...

SetucoCMS vulnerable to session management

Overview SetucoCMS provided by SetucoCMS Project is a content management system CMS. SetucoCMS contains session management vulnerability. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#80157683: SetucoCMS multiple vulnerabilities

SetucoCMS provided by SetucoCMS Project is a content management system CMS. SetucoCMS contains multiple vulnerabilities listed below. Cross-site request forgery - CVE-2016-4891 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N| Base Score: 5.4 CVSS v2|...

[SECURITY] Fedora 24 Update: shiro-1.3.2-1.fc24

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session managemen t, single sign-on and cryptography services...