CVE-2016-2889

Cross-site request forgery CSRF vulnerability in the Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrar...

CVE-2016-0315

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

Design/Logic Flaw

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

CVE-2016-0315

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

IBM Jazz Reporting Service (JRS) Session Hijacking Vulnerability

IBM Jazz Reporting Service is an optional component of IBM Rational Reporting for Development Intelligence. IBM Jazz Reporting Service JRS has a security vulnerability in the Report Builder and Data Collection Component DCC implementations due to the program retaining session ID validity after...

USN-3024-1 tomcat6, tomcat7 vulnerabilities

It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote attacker could use this issue to possibly list a parent directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu...

Symphony CMS Session Fixation Vulnerability

Symphony CMS is a content management system developed in PHP and MySQL. A session fixation vulnerability exists in Symphony CMS when session.useonlycookies is enabled in the program, which can be exploited by a remote attacker to hijack a web session by submitting the PHPSESSID parameter...

CVE-2016-0386

Cross-site request forgery CSRF vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to hijack the authentication of administrators for requests that delete employees...

VMware vRealize Log Insight Cross-Site Scripting Vulnerability

VMware vRealize Log Insight is a suite of log management and analysis tools. A cross-site scripting vulnerability in VMware vRealize Log Insight allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information ...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2016-04109)

Adobe ColdFusion is a dynamic Web server product that runs CFML, a programming language for Web applications. A cross-site scripting vulnerability exists in Adobe ColdFusion, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

Code injection

EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors...

Liferay CE Stored Cross-Site Scripting Vulnerability

Liferay is a J2EE-based portal solution that uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, an enterprise collaboration platform, a social network, and more. A cross-site scripting vulnerability exists in Liferay CE, which allows remote...

Infobae Website Cross-Site Scripting Vulnerability

Infobae is a famous news site. A cross-site scripting vulnerability exists in Infobae Website. An anonymous attacker is able to inject malicious script code into a specially crafted request to hijack the session of a webmaster or user...

Postfix Admin Cross-Site Request Forgery Vulnerability

Postfix Admin is a web-based administration tool for Postfix mail delivery servers. Postfix Admin provides different configuration operations via HTTP GET and HTTP POST, these GET and POST operations cause CSRF attacks. Attackers are able to gain access to the administrator session and add...

Multiple I-O DATA Products Cross-Site Scripting Vulnerabilities

The I-O DATA WN-G300R is a wireless LAN router product from I-O DATA Japan. A cross-site scripting vulnerability exists in multiple I-O DATA WN-G300R products, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to...

IBM Rational Team Concert HTML Injection Vulnerability

IBM Rational Team Concert is a software lifecycle management solution based on the Jazz platform and supports decentralized teams to collaborate in real time. An HTML injection vulnerability exists in IBM Rational Team Concert, which can be exploited by remote attackers to inject malicious script...

Cross-Site Scripting Vulnerability in Multiple Huawei Products

Huawei PLK PLK-AL10C00B211 is a smartphone product from Huawei, China. A cross-site scripting vulnerability exists in the Email application of multiple Huawei PLK PLK-AL10C00B211 products, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which ca...

WebSVN cross-site scripting vulnerability (CNVD-2016-02878)

WebSVN is a set of Web-based Subversion Repository browser. A cross-site scripting vulnerability in WebSVN's handling of directory names or filenames allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

Netgear Router Cross-Site Scripting Vulnerability

The NETGEAR Router is the router device. A cross-site scripting vulnerability exists in Netgear Router Firmware version 1.0.0.24. An attacker is able to steal a cookie to intercept the session of a logged in user...

BlackBerry Enterprise Service Cross-Site Scripting Vulnerability (CNVD-2016-02336)

BlackBerry Enterprise Server is a wireless solution. The solution provides a unified architecture for mobile devices to access enterprise applications, wireless email communications. A cross-site scripting vulnerability exists in BlackBerry Enterprise Server, which allows remote attackers to...