Magento Community Edition 2.1.x < 2.1.2 Multiple Vulnerabilities

Binary data 8965.prm...

Edusson (Robotdon) BB - Bypass & Persistent Vulnerability

Document Title: =============== Edusson Robotdon BB - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1870 Release Date: ============= 2016-11-03 Vulnerability Laboratory ID VL-ID: ==================================== 18...

IBM WebSphere Application Server 8.5 < 8.5.5.6 Multiple Vulnerabilities (FREAK)

Binary data 9716.prm...

Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities

Document Title: =============== Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1906 Release Date: ============= 2016-10-20 Vulnerability Laboratory ID VL-ID: ===================================...

Revive Adserver: Weak Forgot Password implementation

"Cricetinae" : Short Description The Forgot Password is missing a several industry best practices. I strongly believe due to the level of the access given after a successful exploitation, the implementation could have been better. Vulnerability Details Referring to OWASP Standards and guidelines...

IBM FileNet Workplace XT and FileNet Workplace Cross-Site Scripting Vulnerabilities

IBM FileNet Workplace XT and FileNet Workplace are among the client Web applications that provide access to file management and business process management. A cross-site scripting vulnerability exists in IBM FileNet Workplace XT and FileNet Workplace, which could be exploited by remote attackers ...

Contenido v4.9.11 - (Backend) Multiple XSS Vulnerabilities

Document Title: =============== Contenido v4.9.11 - Backend Multiple XSS Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1928 Release Date: ============= 2016-10-10 Vulnerability Laboratory ID VL-ID: ====================================...

RealEstate CMS 3.00.50 - Cross Site Scripting Vulnerability

Document Title: =============== RealEstate CMS 3.00.50 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1949 Release Date: ============= 2016-10-05 Vulnerability Laboratory ID VL-ID: ==================================...

Cyberoam iview UTM v0.1.2.7 - (Ajax) XSS Web Vulnerability

Document Title: =============== Cyberoam iview UTM v0.1.2.7 - Ajax XSS Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1850 Cyberoam ID: 1059276 Security ID: NCR-2064 Release Date: ============= 2016-10-03 Vulnerability Laboratory ID...

Exponent CMS Cross-Site Scripting Vulnerability (CNVD-2016-08139)

Exponent CMS is a free, open source, modular PHP-based content management system. Exponent CMS suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

Privilege escalation

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and consequently gain privileges...

CVE-2016-3305

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and consequently gain privileges...

SA131 : TCP Session Hijacking in Operating Systems Supporting RFC 5961

SUMMARY Blue Coat products that include a vulnerable version of an operating system that supports RFC 5961 are susceptible to a TCP session hijacking vulnerability. A remote, off-path attacker can infer the sequence numbers of an existing TCP connection, and either reset the connection or inject...

Windows Session Object Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that Windows handles session objects. A locally authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit the vulnerability, the attacker could run a specially crafted...

Windows Session Object Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that Windows handles session objects. A locally authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit the vulnerability, the attacker could run a specially crafted...

Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities

Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed...

MS16-111: Security Update for Windows Kernel (3186973)

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple elevation of privilege vulnerabilities exist due to improper handling of session objects. A local attacker can exploit these, via a specially crafted application, to hijack th...

Open-Xchange App Suite 7.8.2 Cross Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...

Open-Xchange App Suite 7.8.2 - Cross Site Scripting

Exploit for cgi platform in category web applications Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status:...

CVE-2016-6394

Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier, aka Bug ID CSCuz80503...