UBUNTU-CVE-2014-9015

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...

CVE-2014-9015

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...

CVE-2014-9015

CVE-2014-9015 affects Drupal 6.x before 6.34 and Drupal 7.x before 7.34. A crafted request (to a server handling both HTTP and HTTPS) can hijack an active user session. The vulnerability stems from how sessions are managed in these versions, enabling an attacker to take over another user’s sessio...

CVE-2014-9015

Removed by vendor...

Supr Shopsystem 5.1.0 - Persistent UI Vulnerability

Exploit for php platform in category web applications Product & Service Introduction: =============================== SUPR is a modern and user-friendly system which allows each store very quickly and easily create their own online store. Without installation and own webspace you can begin to...

Drupal 6.x < 6.34 / 7.x < 7.34 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.34 or 7.x prior to 7.34. It is, therefore, potentially affected by the following vulnerabilities : - There exists an unspecified flaw that is triggered when handling a specially crafted request that may allow a remote...

Debian DSA-3075-1 : drupal7 - security update

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2014-9015 Aaron Averill discovered that a specially crafted request can give a user access to another user's...

[SECURITY] [DSA 3075-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3075-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 20, 2014 http://www.debian.org/security/faq -...

Drupal Denial of Service Session Hijacking Patch

Details on a patched denial of service vulnerability in the open source Drupal content management system have been disclosed. The vulnerability, patched yesterday, could be abused to crash a website running on the CMS. Researchers Michael Cullum, Javier Nieto and Andres Rojas Guerrero reported th...

drupal: session hijacking and denial of service

Custom configured session.inc and password.inc need to be audited as well to verify if they are prone to the following vulnerabilities. More information can be found in the upstream advisory 0. - CVE-2014-9015 session hijacking Aaron Averill discovered that a specially crafted request can give a...

Debian: Security Advisory (DSA-3075-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2014-006

Session hijacking Drupal 6 and 7 A specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session. This attack is known to be possible on certain Drupal 7 sites which serve both HTTP and HTTPS content "mixed-mode", but it is possible...

Ebay Magento Bug Bounty #1 - Persistent API Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 1 - Persistent API Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1202 eBay Inc. Bug Bounty Program ID: EIBBP-26643 Release Date: ============= 2014-11-17 Vulnerability Laboratory ID...

Ebay Magento Bug Bounty #1 - Persistent API Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 1 - Persistent API Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1202 eBay Inc. Bug Bounty Program ID: EIBBP-26643 Release Date: ============= 2014-11-17 Vulnerability Laboratory ID...

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities

No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20141106-0 ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080...

Supr Shopsystem - Persistent UI Vulnerability

Document Title: =============== Supr Shopsystem - Persistent UI Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1353 Release Date: ============= 2014-11-07 Vulnerability Laboratory ID VL-ID: ==================================== 1353 Common...

SeasonApps iTransfer 1.1 Script Insertion

Document Title: =============== SeasonApps iTransfer 1.1 - Persistent UI Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1347 Release Date: ============= 2014-10-27 Vulnerability Laboratory ID VL-ID: ==================================== 134...

Block.io: Various Low level Vulnerabilities

1.XSS protection Not Enabled: Example URL: https://block.io/js/secure/secrets.js?mtime=1412493238 Web Browser XSS Protection is not enabled, or is disabled by the configuration of the 'X-XSS-Protection' HTTP response header on the web server The X-XSS-Protection HTTP response header allows the we...

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable...

SeasonApps iTransfer 1.1 - Persistent UI Vulnerability

Document Title: =============== SeasonApps iTransfer 1.1 - Persistent UI Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1347 Release Date: ============= 2014-10-27 Vulnerability Laboratory ID VL-ID: ==================================== 134...