CVE-2019-3868

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

Pulse Connect Secure and Pulse Policy Secure Multiple Security Vulnerabilities

Description Pulse Connect Secure and Pulse Policy Secure are prone to the following vulnerabilities: 1. An arbitrary file read vulnerability 2. An arbitrary file-write vulnerability 3. A session-hijacking vulnerability 4. Multiple cross-site scripting vulnerabilities 5. Multiple information...

CVE-2019-3868

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

Easter Attack Affects Half a Billion Apple iOS Users via Chrome Bug

UPDATE About a half a billion Apple iOS users and counting have been hit by session-hijacking cybercriminals bent on serving up malware. They’re exploiting an unpatched flaw in the Chrome for iOS browser, to bypass sandboxing and hijack user sessions, targeting iPhone and iPad users. The attacks...

ZEIT: Stored XSS on Zeit.co user profile

Hello team, There is a possibility to have a stored XSS in user profile. Steps to reproduce: 1. Go to zeit.co 2. Click on "Join for free" at the top right side of the page to go to https://zeit.co/signup 3. Select "Continue with GITLAB" note that you must have your Gitlab account logged in 4. Cli...

Design/Logic Flaw

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

CVE-2018-0382

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

CVE-2018-0382

CVE-2018-0382 describes a vulnerability in Cisco Wireless LAN Controller (WLC) Software affecting the web-based interface session management. The issue arises because the software does not properly clear previously assigned session identifiers when a user authenticates, enabling an unauthenticate...

CVE-2018-0382 Cisco Wireless LAN Controller Software Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

CVE-2018-0382 Cisco Wireless LAN Controller Software Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

Cisco Wireless LAN Controller Software Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

Open-Xchange: Another Stored XSS in mail app using Drive app

Vulnerability Details: When replying to a HTML E-Mail with specific payload, that payload could be executed as script code. The user would have to have HTML composing enabled to exploit this vulnerability. This vulnerability could happen as browsers incorrectly "fix" HTML content as demonstrated ...

Open-Xchange: Stored XSS in mail app

Vulnerability Details: When replying to a HTML E-Mail with specific payload, that payload could be executed as script code. The user would have to have HTML composing enabled to exploit this vulnerability. This vulnerability could happen as browsers incorrectly "fix" HTML content as demonstrated ...

TeleKiller - A Tool Session Hijacking And Stealer Local Passcode Telegram Windows

A Tools Session Hijacking And Stealer Local passcode Telegram Windows. Features : Session Hijacking Stealer Local Passcode Keylogger Shell Bypass 2 Step Verification Bypass Av Coming Soon InstallationWindows git clone https://github.com/ultrasecurity/TeleKiller.git cd TeleKiller pip install -r...

Cross site scripting

IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...

CVE-2018-1943

IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...

ShoreTel Connect ONSITE 19.49.1500.0 - Multiple Vulnerabilities

ShoreTel Connect ONSITE 19.49.1500.0 - Multiple Vulnerabilities Exploit Title: Shoretel Connect Multiple Vulnerability Google Dork: inurl:/signin.php?ret= Date: 14/06/2017 Author: Ramikan Vendor Homepage: https://www.shoretel.com/ Software Link:...

ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities

Exploit Title: Shoretel Connect Multiple Vulnerability Google Dork: inurl:/signin.php?ret= Date: 14/06/2017 Author: Ramikan Vendor Homepage: https://www.shoretel.com/ Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview Version: Tested on 18.62.2000.0,...

ShoreTel Connect ONSITE Cross Site Scripting / Session Fixation

Exploit Title: Shoretel Connect Multiple Vulnerability Google Dork: inurl:/signin.php?ret= Date: 14/06/2017 Author: Ramikan Vendor Homepage: https://www.shoretel.com/ Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview Version: Tested on 18.62.2000.0,...

CVE-2018-20816

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with scri...