2106 matches found
OracleVM 3.3 : gnutls (OVMSA-2015-0101)
The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2015-0282 1198159 - fix CVE-2015-0294 1198159 - Corrected value initialization in mpi printing 1129241 - Check for expiry information in the CA certificates 1159778 - fix issue with integer...
CVE-2015-4262: Undefined Security Weakness
The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.55 MR3 and 8.6 before 8.62 does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839...
CollabNet Subversion Edge insecure password change
Vuln Title: The CollabNet Subversion Edge management frontend does not require current password upon password change Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Insecure password change...
Novell ZENworks Configuration Management Session ID Information Disclosure (CVE-2015-0784)
An information disclosure vulnerability exists in Novell ZENworks Configuration Management. The vulnerability is due to exposure of insecure functionality within Rtrlet.class. A remote unauthenticated attacker can leverage this vulnerability to disclosure Session IDs of the logged in users which...
IBM WebSphere MQIPT Information Disclosure Vulnerability
IBM WebSphere MQ is a solution for providing messaging services in the enterprise. IBM WebSphere MQIPT fails to properly handle HTTP session IDs, allowing remote attackers to exploit the vulnerability to guess the session ID to intercept MQ message data...
[RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session ID
Advisory: Alcatel-Lucent OmniSwitch Web Interface Weak Session ID During a penetration test, RedTeam Pentesting discovered a vulnerability in the management web interface of an Alcatel-Lucent OmniSwitch 6450. This interface uses easily guessable session IDs, which allows attackers to authenticate...
Alcatel-Lucent OmniSwitch Web Interface Weak Session ID
Advisory: Alcatel-Lucent OmniSwitch Web Interface Weak Session ID During a penetration test, RedTeam Pentesting discovered a vulnerability in the management web interface of an Alcatel-Lucent OmniSwitch 6450. This interface uses easily guessable session IDs, which allows attackers to authenticate...
Alcatel-Lucent OmniSwitch Web Interface Weak Session ID Vulnerability
Vulnerability in the management web interface of an Alcatel-Lucent OmniSwitch 6450. This interface uses easily guessable session IDs, which allows attackers to authenticate as a currently logged-in user and perform administrative tasks Details ======= Product: Alcatel-Lucent OmniSwitch 6450, 6250...
CVE-2015-0763: Exposure of Sensitive Information to an Unauthorized Actor
Cisco Unified MeetingPlace 8.61.2 does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338...
CVE-2015-2853
CVE-2015-2853 is a session-fixation vulnerability in the WebUI of Blue Coat SSL Visibility Appliance (SV800, SV1800, SV2800, SV3800) affecting versions 3.6.x–3.8.x up to 3.8.4. The root cause is that the session ID is set before authentication and is not invalidated or changed after login, enabli...
CVE-2015-2853: Undefined Security Weakness
Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID...
EasyCTF Unauthorized Access Vulnerability
EasyCTF is a CGI program for scoring CTFs. EasyCTF fails to properly verify session IDs, allowing remote attackers to gain unauthorized access via special HTTP requests...
Cross site request forgery (csrf)
EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request...
CVE-2015-0914
EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request...
CVE-2015-0914
CVE-2015-0914 affects EasyCTF prior to 1.4. The vulnerability is a session management weakness (CWE-639) where session IDs are not validated, allowing a remote attacker to gain unauthorized access via a crafted HTTP request. Impact stated: possible login and information disclosure without credent...
PT-2015-4965
Name of the Vulnerable Software and Affected Versions EasyCTF versions prior to 1.4 Description The issue allows remote attackers to obtain access via a crafted HTTP request due to the lack of session ID validation. Recommendations For versions prior to 1.4, update to version 1.4 or later to...
CVE-2015-0914: Improper Access Control
EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request...
Novell Zenworks Rtrlet.class Session ID Disclosure Vulnerability
This vulnerability allows attackers to disclose Session ID's of logged in users on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. The specific flaw exists within Rtrlet.class. By sending a POST request with the maintenance variable set...
Inductive Automation Ignition < 7.7.4 Multiple Vulnerabilities
Inductive Automation Ignition is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Shopify: Force 500 Internal Server Error on any shop (for one user)
There is very strange behavior. If user open urls like below: - https://whashp.myshopify.com/?previewthemeid=11288717 - or https://lmfshp.myshopify.com/?previewthemeid=11290937 He got redirect to shop https://whashp.myshopify.com/ and 500 Internal Server Error response, and reload does not help i...