Cross-Site Scripting (XSS)

Apache JSPWiki is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the ReferredPagesPlugin and navigation breadcrumbs, to steal session tokens or perform unwanted actions on behalf of the user...

Debian: Security Advisory (DSA-4446-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4446-1 : lemonldap-ng - security update

It was discovered that the Lemonldap::NG web SSO system performed insufficient validation of session tokens if the 'tokenUseGlobalStorage'option is enabled, which could grant users with access to the main session database access to an anonymous session. C Tenable Network Security, Inc. The...

[SECURITY] [DSA 4446-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4446-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 14, 2019 https://www.debian.org/security/faq -...

PT-2019-2929

Name of the Vulnerable Software and Affected Versions LemonLDAP::NG version 2.0.3 Description The issue is related to incorrect access control in the authentication system for web applications. It involves insufficient validation of session tokens, which can be exploited by a remote attacker to...

CRLF Injection

jenkins is vulnerable to CRLF injection. A remote attacker is able to inject arbitrary HTTP headers or perform HTTP response splitting attacks to steal user's session tokens, perform unwanted actions on behalf of the user or perform phishing attacks on users...

Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

com.liferay.currency.converter.web is vulnerable to cross-site scripting XSS attacks. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the symbol to steal session tokens or perform unwanted actions on behalf of the user...

CVE-2019-11213

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. The endpoint would need to be already compromised for exploitation to succeed...

Sql injection

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. The endpoint would need to be already compromised for exploitation to succeed...

CVE-2019-11213

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. The endpoint would need to be already compromised for exploitation to succeed...

PT-2019-12191 · Pulse · Pulse Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Pulse Desktop Client versions 5.x through 5.3R6 Pulse Desktop Client versions 9.x through 9.0R2 Pulse Connect Secure versions 8.1 through 8.1R13 Pulse Connect Secure versions 8.3 through 8.3R6 Pulse Connect Secure versions 9.0 through 9.0R2...

Authentication flaw

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN...

CVE-2019-1573 Information Disclosure in GlobalProtect Agent

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN...

CVE-2019-1573

CVE-2019-1573 affects Palo Alto Networks GlobalProtect Agent 4.1.0 for Windows and 4.1.10 and earlier for macOS. A local, authenticated attacker who has compromised the end-user account and can inspect memory could access authentication/session tokens and replay them to spoof the VPN session and ...

Information Disclosure in GlobalProtect App

An information disclosure vulnerability exists in the GlobalProtect App for Windows and macOS VU192371. Successful exploitation of this issue would allow a local authenticated attacker to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the...

CVE-2019-1573: Sensitive Information in Resource Not Removed Before Reuse

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN...

Cross-Site Scripting (XSS)

kibana is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

Information Disclosure

Apache Tomcat is vulnerable to information disclosure. The character sequence " in a cookie value is incorrectly handled, allowing a remote user to exploit the vulnerability to obtain users' session tokens and gain access to the application as the victims...

Cross-Site Scripting (XSS)

Apache Tomcat is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the time parameter in cal2.jsp to steal session tokens or perform unwanted actions on behalf of the user...