Code injection

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253...

Craft CMS 2.6 Cross Site Scripting / File Upload

Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip Version: 2.6 Tested on: Kali Linux 2.0 | Windows 8.1...

Perch v3.0.3 CMS - Multiple Web Vulnerabilities

Document Title: =============== Perch v3.0.3 CMS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2067 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15948 CVE-ID: ======= CVE-2017-15948 Release Date: ============...

IBM Tivoli Federated Identity Manager Cross-Site Scripting Vulnerability (CNVD-2017-09951)

IBM Tivoli Federated Identity Manager is a cross-enterprise federated identity management product from IBM USA. A cross-site scripting vulnerability in IBM Tivoli Federated Identity Manager allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be...

Verizon Patches XSS Issues in its Messaging Client

Verizon late last year patched a vulnerability in its Message+ messaging client that could have allowed an attacker to take over a session and possibly extend their reach into a user’s account management settings. Researcher Randy Westergren yesterday disclosed some details on the bug, which coul...

McAfee Network Data Loss Prevention Session Hijacking Vulnerability (CNVD-2017-07550)

McAfee Network Data Loss Prevention is a data leakage protection solution. McAfee Network Data Loss Prevention NDLP suffers from a session-side hijacking vulnerability in the server implementation, which can be exploited by remote attackers to view, add, and delete users by modifying HTTP request...

CVE-2017-4014

Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request...

CVE-2017-4014

Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request...

XSS in SAP NetWeaver AS Java SRM

Application: SAP SRM Versions Affected: SAP SRM 701 – 714 Vendor URL: SAP Bug: XSS Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 08.08.2017 Reference: SAP Security Note 2493099 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS Risk: Medium Impact:...

WordPress EELV Newsletter 4.5 XSS / CSRF Vulnerabilities

Exploit for php platform in category web applications Document Title: =============== Wordpress EELV Newsletter v4.5 - Multiple Vulnerabilities Product & Service Introduction: =============================== Add a registration form on FrontOffice, a newsletter manager on backoffice manage skins,...

WordPress EELV Newsletter 4.5 XSS / CSRF

Document Title: =============== Wordpress EELV Newsletter v4.5 - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2069 Release Date: ============= 2017-05-15 Vulnerability Laboratory ID VL-ID: ====================================...

XSS in CRM (Java)

Application: SAP CRM Versions Affected: SAP CRM 700-732 Vendor URL: SAP Bug: XSS Reported: 16.05.2017 Vendor response: 17.05.2017 Date of Public Advisory: 08.08.2017 Reference: SAP Security Note 2481262 Author: Vladimir Egorov ERPScan VULNERABILITY INFORMATION Class: XSS Risk: Medium Impact:...

Session Hijacking, Cookie-Stealing WordPress Malware Spotted

Researchers have identified a strain of cookie stealing malware injected into a legitimate JavaScript file, that masquerades as a WordPress core domain. Cesar Anjos, a security analyst at Sucuri, a firm that specializes in WordPress security, came across the malware during an incident response...

Zenario 7.6 Persistent Cross Site Scripting

Document Title: =============== Zenario v7.6 - Persistent Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2044 https://github.com/TribalSystems/Zenario/commit/cd60f1c8a179ebb779fe0acc051b93f477129b1a Release Date:...

Invision Power Services Community Suite Security Bypass Vulnerability

Invision Power Services IPS Community Suite is an integrated application for building communities on the web. A security bypass vulnerability exists in versions of IPS Community Suite prior to 4.1.9. An attacker could exploit the vulnerability to hijack a session...

IBM Maximo Asset Management Session Hijacking Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A security...

CVE-2016-8924

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...

Code injection

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230...

CVE-2016-8924

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...

CVE-2016-8924

CVE-2016-8924 affects IBM Maximo Asset Management core versions 7.1, 7.5 and 7.6 (and related Industry Solutions/Control Desk products). The vulnerability stems from failing to invalidate an existing session identifier, enabling remote session hijacking to access another user’s session. IBM’s Sec...