Transform Foundation Server 4.3.1 / 5.2 Cross Site Scripting

I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in Transform Foundation server 4.3.1 and 5.2 from Bottomline Technologies II. BACKGROUND ------------------------- Bottomline offers powerful, next-generation electronic document solutions for formatting, personalizi...

CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

CVE-2012-5391

CVE-2012-5391 describes a session fixation vulnerability in MediaWiki's Special:UserLogin. The issue allows remote attackers to hijack user sessions by manipulating the session_id in affected releases. Affected versions are MediaWiki < 1.18.6, < 1.19.3 (1.19.x), and

CVE-2012-5391: Undefined Security Weakness

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

PT-2014-2307

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.18.6 MediaWiki versions 1.19.x prior to 1.19.3 MediaWiki versions 1.20.x prior to 1.20.1 Description The issue allows remote attackers to hijack web sessions via the session id. This is related to a session fixati...

InterScan Messaging Security Virtual Appliance 8.5.1.1516 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Attacks vulnerability in InterScan Messaging Security Virtual Appliance 8.5.1.1516 II. DESCRIPTION ------------------------- Has been detected a XSS vulnerability in InterScan Messaging Security Virtual Appliance version 8.5.1.1516. The code injectio...

info.vmware.com Cross Site Scripting

Advisory: info.vmware.com – Cross-Site Script Vulnerability XSS Advisory ID: VMware Support Request 14479234605 Author: Roberto Garcia Affected Software: Successfully tested on info.vmware.com Vendor URL: htt://info.vmware.com Vendor Status: informed ========================== Vulnerability...

CVE-2014-0214

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

Code injection

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-0214

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-0214: Improper Authentication

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-0214

CVE-2014-0214 affects Moodle versions up to 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3. The vulnerability arises in login/token.php, which creates a MoodleMobile web-service token with an infinite lifetime. This allows remote attackers to hijack sessions more easily v...

CVE-2013-3046

The CVE-2013-3046 entry concerns IBM Sametime Meeting Server (versions 8.x up to 8.5.2.1 and 9.x up to 9.0.0.1) failing to send the HSTS Strict-Transport-Security header. The root cause is the absence of HSTS protection, which could allow MITM attackers to hijack sessions or obtain sensitive data...

PT-2014-2646

Name of the Vulnerable Software and Affected Versions IBM Sametime versions 8.x through 8.5.2.1 IBM Sametime versions 9.x through 9.0.0.1 Description The issue concerns the Meeting Server in IBM Sametime, which fails to send the HSTS Strict-Transport-Security header. This omission makes it easier...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update

Updated tomcat6 packages that fix multiple security issues are now available for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update

An update for the Apache Tomcat 6 component for Red Hat JBoss Web Server 2.0.1 that fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CV...

PT-2014-2382

Name of the Vulnerable Software and Affected Versions Atlassian Confluence version 3.4.6 Description A cross-site request forgery CSRF issue exists in the logout.action of Atlassian Confluence, allowing remote attackers to hijack the authentication of administrators for requests that logout the...

Coinbase: Simultaneous Session Logon : Improper Session Management

Hi, I would like to report this bug related to improper simultaneous logon. Issue: 1 When a user is logged in to the application already authenticated, visits the login page https://coinbase.com/signin he/she should directly get redirected to their home page as there is already a session running...

Jasper Server 5.5 Session Fixation

Session Fixation / Hijacking on JasperServer + Date: 09/05/2014 + Risk: High + CWE number: CWE-384 + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.jaspersoft.com/ + Software Download : http://sourceforge.net/projects/jasperserver/ + Contact: [email protected] + Tested on:...