CVE-2016-3840

Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153...

PT-2016-2548

Name of the Vulnerable Software and Affected Versions Conscrypt in Android versions 4.x through 4.4.3 Conscrypt in Android versions 5.0.x through 5.0.1 Conscrypt in Android versions 5.1.x through 5.1.0 Conscrypt in Android versions 6.x before 2016-08-05 Description The issue is related to the...

CVE-2016-3840: Undefined Security Weakness

Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153...

CVE-2016-3840

Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153...

IBM Security Identity Manager Design Vulnerability

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

tomcat: Session fixation

A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests...

tomcat: Session fixation

A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests...

Unspecified Vulnerability in Haxx Libcurl

Haxx Libcurl is a free , open source client-side URL transfer library from the Swedish company Haxx. The library supports FTP, FTPS, TFTP, HTTP and so on. The 'ConnectionExists' function in the lib/url.c file of Haxx Libcurl fails to correctly reuse NTLM-authenticated proxy connections, allowing ...

eWON Weak Session Management Vulnerability

eWON is an industrial router product from eWON Belgium. A security vulnerability exists in eWON using firmware versions prior to 10.1s0, which stems from the program retaining a session after a user logs out and logs in. An attacker could exploit the vulnerability to interact with the device usin...

Inductive Automation Ignition Invalid Session Expires Vulnerability

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Ignition does not delete the session after the user logs out, which can allow an attacker to reuse the current session...

Mandriva Linux Security Advisory : nginx (MDVSA-2015:094)

Updated nginx package fixes security vulnerabilities : A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution...

PT-2015-07: Privilege Gaining in Inductive Automation Ignition

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in Inductive Automation Ignition. After user’s logout session is not removed which could lead to session reuse by attacker with privileges of the same user. How to fix Update your sofware up to the...

Secure Transport certificate check bypass

libcurl stores TLS Session IDs in its associated Session ID cache when it connects to TLS servers. In subsequent connects it reuses the entry in the cache to resume the TLS connection faster than when doing a full TLS handshake. The actual implementation for the Session ID caching varies dependin...

CVE-2014-3616

nginx 0.5.6 through 1.7.4, when using the same shared sslsessioncache or sslsessionticketkey for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks...

SSL session reuse vulnerability

SSL session reuse vulnerability Severity: medium CVE-2014-3616 Not vulnerable: 1.7.5+, 1.6.2+ Vulnerable: 0.5.6-1.7.4...

CVE-2014-3616: Insufficient Session Expiration

nginx 0.5.6 through 1.7.4, when using the same shared sslsessioncache or sslsessionticketkey for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks...

Design/Logic Flaw

The MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13, when using the file-based session store Apache::Session::File and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and cache...

CVE-2013-3737

The MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13, when using the file-based session store Apache::Session::File and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and cache...

CVE-2013-3737: Exposure of Sensitive Information to an Unauthorized Actor

The MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13, when using the file-based session store Apache::Session::File and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and cache...

PT-2014-2709

Name of the Vulnerable Software and Affected Versions Request Tracker versions 4.0.0 through 4.0.12 MobileUI extension versions prior to 1.04 Description The issue allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches. This occurs when using the file-based...