2895 matches found
CVE-2019-10405
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly...
Exploit for OS Command Injection in Webmin
It is an exploit module for CVE-2019-15107, a vulnerability in Webmin. The target product/service is Webmin, a web-based interface for system administration. The vulnerability class/vector is a remote command execution RCE vulnerability. The probable entry point is the "passwordchange.cgi" script...
Joomla 3.4.6 - (configuration.php) Remote Code Execution Exploit
Exploit for php platform in category web applications Exploit Title: Joomla 3.4.6 - 'configuration.php' Remote Code Execution Google Dork: N/A Date: 2019-10-02 Exploit Author: Alessandro Groppo @Hacktive Security Vendor Homepage: https//www.joomla.it/ Software Link:...
Cross site scripting
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly...
CVE-2019-10405
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly...
CVE-2019-10405
CVE-2019-10405 affects Jenkins 2.196 and earlier, and LTS 2.176.3 and earlier. The vulnerability causes the server to print the value of the cookie in the /whoAmI/ URL, despite the cookie being marked HttpOnly. This enables an attacker who can exploit another XSS vulnerability to obtain the HTTP ...
CVE-2019-14912
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie...
CVE-2019-14912
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie...
Open redirect
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie...
CVE-2019-14912
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie...
CVE-2019-14912
The CVE-2019-14912 entry concerns PRiSE adAS 1.7.0, where the OPENSSO module fails to validate the goto parameter, causing an open redirect that leaks the user session cookie. Multiple sources (NVD, Red Hat, CVE lists) confirm the affected product and the underlying cause. Exploitation details an...
PT-2019-13860
Name of the Vulnerable Software and Affected Versions PRiSE adAS version 1.7.0 Description An issue in the OPENSSO module of PRiSE adAS does not properly check the goto parameter, leading to an open redirect. This results in the leakage of the session cookie. Recommendations For version 1.7.0,...
CVE-2019-14912: URL Redirection to Untrusted Site
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie...
CVE-2019-16238
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...
CVE-2019-16238
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...
CVE-2019-16238
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...
CVE-2019-15955
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with On=2n instead of On=n^x complexity...
CVE-2019-15955
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with On=2n instead of On=n^x complexity...
Totaljs CMS 12.0 Insecure Admin Session Cookie
Author/Discoverer: Riccardo Krauter @CertimeterGroup + Title: Totaljs CMS Insecure Admin Session cookie + Affected software: Totaljs CMS 12.0 + Description: A low privilege user can easily crack the owned cookie to obtain the “random” values inside it. If this user can leak a session cookie owned...