CVE-2013-5709

The authentication implementation in the web server on Siemens SCALANCE X-200 switches with firmware before 5.0.0 does not use a sufficient source of entropy for generating values of random numbers, which makes it easier for remote attackers to hijack sessions by predicting a value...

CVE-2013-5709

CVE-2013-5709 affects Siemens SCALANCE X-200 switches running firmware before 5.0.0. The vulnerability stems from an insufficient entropy source in the web server’s RNG used for session authentication, enabling remote attackers to hijack Web sessions by predicting random values. Documents from NV...

PT-2013-5743

Name of the Vulnerable Software and Affected Versions Siemens SCALANCE X-200 switches versions prior to 5.0.0 Description The issue concerns the authentication implementation in the web server, which does not utilize a sufficient source of entropy for generating random numbers. This makes it easi...

CVE-2013-5709: Undefined Security Weakness

The authentication implementation in the web server on Siemens SCALANCE X-200 switches with firmware before 5.0.0 does not use a sufficient source of entropy for generating values of random numbers, which makes it easier for remote attackers to hijack sessions by predicting a value...

PT-2013-5578

Name of the Vulnerable Software and Affected Versions Cisco Unified MeetingPlace Solution affected versions not specified Description A cross-site request forgery CSRF issue in the web framework of Cisco Unified MeetingPlace Solution allows remote attackers to hijack the authentication of arbitra...

Juniper NSM Linux Kernel TCP Sequence Number Generation Issue (PSN-2012-08-688)

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially vulnerable to denial of service and network session hijacking attacks due to a weak IP sequence number generator. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Design/Logic Flaw

IBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout action, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

CVE-2013-2997

IBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout action, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

PT-2013-4087

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions prior to 8.7 Description The issue allows remote attackers to hijack sessions by leveraging an unattended workstation, due to the failure to invalidate the session context upon a logout action...

PT-2013-4511

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies. Recommendations For version 6.6,...

eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability

Document Title: =============== eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1064 Release Date: ============= 2013-08-30 Vulnerability Laboratory ID VL-ID: ===================================...

[CookieCatcher] Session Hijacking Tool

CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used without proper...

PHP 5.5.x < 5.5.3 Multiple Vulnerabilities

According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.3. It is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the 'Sessions' subsystem that can allow an attacker to hijack the session of another...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

Default credentials

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4762

Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4762

CVE-2013-4762 affects Puppet Enterprise before 3.0.1: the logout flow does not sufficiently invalidate the user session, which could allow remote attackers to hijack a session by obtaining an old session ID. This root cause is consistently described across multiple sources (NVD, Red Hat, Ubuntu, ...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4762

Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID...