Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2017-22157)

Cisco Identity Services Engine is a conversion-generating technology that provides a unified access path and policy path for network users and devices. A cross-site scripting vulnerability exists in Cisco Identity Services Engine, which allows remote attackers to exploit the vulnerability to inje...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2017-13258)

Elasticsearch Kibana is a suite of open source, browser-based tools for analyzing and searching Elasticsearch dashboards. A cross-site scripting vulnerability exists in Elasticsearch Kibana, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

Design/Logic Flaw

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-6703

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, remote attacker to hijack another user's session. More Information: CSCvc90346. Known Affected Releases: 12.1...

CVE-2017-6703

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, remote attacker to hijack another user's session. More Information: CSCvc90346. Known Affected Releases: 12.1...

Multiple Pivotal Product Session Fixation Vulnerabilities

Cloud Foundry is an open source cloud computing platform. uAA is a user authentication module, a Java Spring project. A session fixation vulnerability exists in multiple Pivotal products. An attacker could hijack arbitrary sessions and gain unauthorized access to affected applications...

ownCloud cross-site scripting vulnerability (CNVD-2017-16363)

ownCloud is the open source file synchronization and sharing solution. A cross-site scripting vulnerability exists in ownCloud, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions,...

Gratipay: Possible User Session Hijack using Invalid HTTPS certificate on inside.gratipay.com domain

Good evening team! This is a theoretical risk but I thought it was still worth reporting since every endpoint and any data flowing through inside.gratipay.com is unencrypted. POC https://inside.gratipay.com And every sub directory under inside.gratipay.com. Description Since the certificate is on...

Gratipay: Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domain

Good evening team! This is a theoretical risk but I thought it was still worth reporting since every endpoint and any data flowing through inside.gratipay.com is unencrypted. POC https://inside.gratipay.com And every sub directory under inside.gratipay.com. Description Since the certificate is on...

CMS Made Simple adminaddgroup.php file cross-site scripting vulnerability

CMS Made Simple is a free web-based content publishing system. A cross-site scripting vulnerability exists in the CMS Made Simple adminaddgroup.php file, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensiti...

Apache NiFi Cross-Site Scripting Vulnerability (CNVD-2017-14424)

Apache NiFi is a system data flow automation solution. Apache NiFi suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user sessions...

CVE-2016-7809

Cross-site request forgery CSRF vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows remote attackers to hijack the authentication of logged in user to conduct unintended operations via unspecified vectors...

CVE-2016-9977

CVE-2016-9977 affects IBM Maximo Asset Management core products 7.1, 7.5, and 7.6 (and related Industry Solutions and IBM Control Desk on top) with a vulnerability that allows remote session hijacking due to failure to invalidate an existing session identifier. Affected products include Maximo As...

CVE-2016-9977

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253...

XSS cross-site scripting vulnerability in the 'language' parameter of UFIDA U8+ system

UFIDA U8+ is to support enterprises to realize multi-end PC, cell phone, tablet and other devices multi-system windows, iOS, Android and other mainstream systems application deployment of business software. An XSS cross-site scripting vulnerability exists in the 'language' parameter of the UFIDA...

Multiple vulnerabilities in FortiPortal (CNVD-2017-10727)

FortiPortal is Fortinet's advanced, feature-rich hosted security analytics and management enabler that serves as an MSP for VM software solutions/products that can be deployed on hosted service infrastructures. FortiPortal has multiple security vulnerabilities. The vulnerabilities can be exploite...

Code injection

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...

CVE-2017-1170

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230...

CVE-2017-1170

CVE-2017-1170 affects IBM WebSphere Commerce 8.0 (Enterprise, Professional, Express, Developer). A local user can hijack another user’s session, indicating a local elevation of privileges with partial confidentiality/integrity/availability impact. The provided documents do not specify the root ca...