4003 matches found
Cisco Firepower Management Center Session Fixation Vulnerability
A vulnerability in session identification management functionality of the web-based management interface for Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to hijack a valid user session. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be...
Cisco FireSIGHT System Software Session Fixation Vulnerability
A vulnerability in session identification management functionality of the web-based management interface for Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to hijack a valid user session. The vulnerability exists because the affected application does not assign a...
Cisco Firepower Management Center and FireSIGHT System Software Session Fixation Vulnerability
A vulnerability in session identification management functionality of the web-based management interface for Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to hijack a valid user session. The vulnerability exists because the...
CumulusClips 2.4.1 - Multiple Vulnerabilities
CumulusClips 2.4.1 - Multiple Vulnerabilities Exploit Title: CumulusClips Session fixation Google Dork: inurl:/cumulusclips/videos/ Date: 2.09.2016 Exploit Author: kor3k / Łukasz Korczyk Vendor Homepage: http://cumulusclips.org/ Software Link: http://cumulusclips.org/cumulusclips.zip Version: 2.4...
CumulusClips 2.4.1 - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: CumulusClips Session fixation Google Dork: inurl:/cumulusclips/videos/ Date: 2.09.2016 Exploit Author: kor3k / Łukasz Korczyk Vendor Homepage: http://cumulusclips.org/ Software Link: http://cumulusclips.org/cumulusclips.zip...
CumulusClips 2.4.1 - Multiple Vulnerabilities
Exploit Title: CumulusClips Session fixation Google Dork: inurl:/cumulusclips/videos/ Date: 2.09.2016 Exploit Author: kor3k / Łukasz Korczyk Vendor Homepage: http://cumulusclips.org/ Software Link: http://cumulusclips.org/cumulusclips.zip Version: 2.4.1 Tested on: Debian Jessie Description:...
CumulusClips 2.4.1 Code Execution / CSRF / Cross Site Scripting
Exploit Title: CumulusClips Session fixation Google Dork: inurl:/cumulusclips/videos/ Date: 2.09.2016 Exploit Author: kor3k / Aukasz Korczyk Vendor Homepage: http://cumulusclips.org/ Software Link: http://cumulusclips.org/cumulusclips.zip Version: 2.4.1 Tested on: Debian Jessie Description:...
Session fixation
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session...
Harvest: Opportunity to set arbitrary cookies
The location hash on a configure page is used to set a cookie value of the same content. Visiting of a page like https://%domain%.harvestapp.com/invoices/configurefoo will result into a foo cookie setting. This value isn't validated at all, which gives an attacker the opportunity to set arbitrary...
ownCloud: [api.owncloud.org] CRLF Injection
PoC: https://api.owncloud.org/%23%0dSet-Cookie:crlf=injection2;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 10:28:01 GMT\r\n Server: Apache\r\n Strict-Transport-Security: max-age=63072000\r\n X-Xss-Protection: 1; mode=block\r\n Location:...
OLX: stored XSS in olx.pl - ogloszenie TITLE element - moderator acc can be hacked
Hello, The OLX.PL is vulnerable to stored XSS attack. When adding new advertisement, it is possible to put a payload in its title here I used Titlealert1 I see ads are being pre-moderated, however it can remain uncaught also the length limit in title field is enough to insert into it e.g. a BeEF...
Session fixation
The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors...
Symphony CMS Session Fixation Vulnerability
Symphony CMS is prone to a session fixation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Symphony CMS Session Fixation Vulnerability
Symphony CMS is a content management system developed in PHP and MySQL. A session fixation vulnerability exists in Symphony CMS when session.useonlycookies is enabled in the program, which can be exploited by a remote attacker to hijack a web session by submitting the PHPSESSID parameter...
CVE-2016-4309
Session fixation vulnerability in Symphony CMS 2.6.7, when session.useonlycookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2016-4309
Session fixation vulnerability in Symphony CMS 2.6.7, when session.useonlycookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2016-4309
Session fixation vulnerability in Symphony CMS 2.6.7, when session.useonlycookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter...
Session fixation
Session fixation vulnerability in Symphony CMS 2.6.7, when session.useonlycookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2016-4309
Symphony CMS 2.6.7 is affected by a session-fixation vulnerability. The issue arises because the system does not regenerate the user’s PHPSESSID upon authentication, allowing an attacker to fix a session token and potentially gain access after a user authenticates. Public sources (Veracode, OpenV...
