USN-1439-1: Horizon vulnerabilities

Matthias Weckbecker discovered a cross-site scripting XSS vulnerability in Horizon via the log viewer refrash mechanism. If a user were tricked into viewing a specially crafted log message, a remote attacker could exploit this to modify the contents or steal confidential data within the same...

CVE-2012-2144

Session fixation vulnerability in OpenStack Dashboard Horizon folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie...

Session fixation

RuggedCom Rugged Operating System ROS 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a 1 TELNET, 2 remot...

Oracle Enterprise Manager vulnerable to Session fixation (CVE-2012-0528)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 AppSecInc Team SHATTER Security Advisory Oracle Enterprise Manager vulnerable to Session fixation. Risk Level: Low Affected versions: Oracle Enterprise Manager Database Control 10.2.0.5, 11.1.0.7 and previous patchsets Remote exploitable: Yes Credits:...

CVE-2012-1238

Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors...

Session fixation

Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2012-1238

CVE-2012-1238 affects SENCHA SNS prior to 1.0.2. The vulnerability is a session-fixation issue that may allow a remote, unauthenticated attacker to impersonate an honest user and access or alter information. Public sources (JVN/JVNDB/NVD) confirm the impact and publicly advise updating to the lat...

CVE-2012-1238

Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors...

SENCHA SNS vulnerable to session fixation

Overview SENCHA SNS contains a session fixation vulnerability. SENCHA SNS is an open source SNS software. SENCHA SNS contains a session fixation vulnerability. Hiroshi Tokumaru of HASH Consulting Corp. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

JVN#97200417: SENCHA SNS vulnerable to session fixation

SENCHA SNS is an open source SNS software. SENCHA SNS contains a session fixation vulnerability. Impact A remote, unauthenticated attacker may impersonate an honest user of the affected product. As a result, information may be altered or obtained. Solution Update the Software Update to the latest...

Session fixation

Janetter before 3.3.0.0 aka 3.3.0 allows remote attackers to obtain session information for twitter.com web sites via unspecified vectors...

Session fixation

EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via unspecified vectors...

Session fixation

IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database CCMDB 6.2, 7.1, and 7.2 all...

Session fixation

The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service application crash via a crafted application that uses a PDO driver for a fetch and then calls the sessionstart function, as demonstrated by...

Session fixation

Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, Altiris Client Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 aka 12.5.x and 12.6.x do not...

Session fixation

CoreUI in Apple Mac OS X 10.7.x before 10.7.3 does not properly restrict the allocation of stack memory, which allows remote attackers to execute arbitrary code or cause a denial of service memory consumption and application crash via a long URL...

Session fixation

Microsoft Forefront Unified Access Gateway UAG 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which allows remote attackers to cause a denial of service IIS outage via unspecified network traffic, aka "Null Session Cookie Crash."...

CVE-2011-3424

Session fixation vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to hijack web sessions via unspecified...

Session fixation

Session fixation vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to hijack web sessions via unspecified...

CVE-2011-3424

CVE-2011-3424 affects TIBCO Managed File Transfer Internet Server (7.0.x–7.1.0) and Command Center (7.0.x–7.1.0), and TIBCO Slingshot (1.8.0 and earlier). Root cause: defects in processing inbound HTTP requests leading to a session fixation vulnerability that can allow an attacker to hijack a web...