Session isn't invalidated on logout

When the user logs out the HttpSession isn't invalidated. The important details of the logged in user and other information is correctly cleared but other properties such as user preferences are not. The impact is things like the label's section and location section's openness state isn't correct...

ZyXEL Gateways Vulnerability Research: http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf

This paper is the result of various security assessments performed on several ZyXEL Prestige devices in both, a controlled environment computer lab and production environments during several penetration tests. There are two types of attacks featured in this paper which we believe might be...

GLSA-200801-11 : CherryPy: Directory traversal vulnerability

The remote host is affected by the vulnerability described in GLSA-200801-11 CherryPy: Directory traversal vulnerability CherryPy does not sanitize the session id, provided as a cookie value, in the FileSession.getfilepath function before using it as part of the file name. Impact : A remote...

CherryPy: Directory traversal vulnerability

Background CherryPy is a Python-based, object-oriented web development framework. Description CherryPy does not sanitize the session id, provided as a cookie value, in the FileSession.getfilepath function before using it as part of the file name. Impact A remote attacker could exploit this...

Debian Security Advisory DSA 537-1 (ruby)

The remote host is missing an update to ruby announced via advisory DSA 537-1. OpenVAS Vulnerability Test $Id: deb5371.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 537-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

f5-xss.txt

F5 BIG-IP Web Management List Search XSS Product: F5 BIG-IP http://www.f5.com/products/big-ip/ The F5 BIG-IP web management interface contains a cross-site scripting vulnerability in the Search function present on several list-like pages. Parameter SearchString is not sanitized before it gets...

Double free

Double free vulnerability in the Widget Library libxfcegui4 in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."...

CVE-2007-6532

Double free vulnerability in the Widget Library libxfcegui4 in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."...

CVE-2007-6532

Double free vulnerability in the Widget Library libxfcegui4 in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."...

CVE-2007-6532

Double free vulnerability in the Widget Library libxfcegui4 in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."...

CVE-2007-6532

CVE-2007-6532 is a double-free vulnerability in libxfcegui4 (Xfce) prior to 4.4.2. The issue arises in session management where freed memory could be accessed, potentially enabling a remote attacker to execute arbitrary code. Gentoo GLSA 200801-06 and related advisories note that affected package...

CVE-2007-6532: Improper Restriction of Operations within the Bounds of a Memory Buffer

Double free vulnerability in the Widget Library libxfcegui4 in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."...

GLSA-200711-17 : Ruby on Rails: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200711-17 Ruby on Rails: Multiple vulnerabilities candlerb found that ActiveResource, when processing responses using the Hash.fromxml function, does not properly sanitize filenames CVE-2007-5380. The session management...

[ GLSA 200711-17 ] Ruby on Rails: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200711-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

Ruby on Rails: Multiple vulnerabilities

Background Ruby on Rails is a free web framework used to develop database-driven web applications. Description candlerb found that ActiveResource, when processing responses using the Hash.fromxml function, does not properly sanitize filenames CVE-2007-5380. The session management functionality...

Mambo 4.6.2 CMS - Session fixation Issue in backend Administration interface

==================================================================================== Team Intell Security Advisory TISA2007-04 ------------------------------------------------------------------------------------ Mambo 4.6.2 CMS - Session fixation Issue in backend Administration interface...

Session fixation in Zen Cart CMS

==================================================================================== Team Intell Security Advisory TISA2007-05 ------------------------------------------------------------------------------------ Zen Cart 1.3.7 - Session fixation Issue in backend Administration interface...

JVN#05187780 Hiki arbitrary file deletion vulnerability

Hiki contains a vulnerability that allows an arbitrary file to be deleted on a server running Hiki. This is caused by the improper handling of a session management file. Impact A remote attacker may be able to delete arbitrary files with the privilege of the user running Hiki. Solution Upgrade th...

[Full-disclosure] Orkut Server Side Session Management Error

Orkut Server Side Session Management Error The most recent version of this document is available at:- http://susam.in/security/advisory-2007-06-22.txt Release date:- 22 June, 2007 Type:- Session management error Authors:- Susam Pal, Vipul Agarwal Researchers:- Susam Pal, Vipul Agarwal, Gaurav Mog...

Debian DSA-1282-1 : php4 - several vulnerabilities

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1286 Stefan Esser discovered an overflow ...