4221 matches found
drexel.edu XSS vulnerability
Vulnerable URL: http://drexel.edu/undergrad/visit/off-campus-information-sessions/EventDetails/?id=7D65E505-96E0-4F29-B185-91679A9A299B=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 07.01.2018 Vulnerability...
HP UCMDB Foundation Software Cross-Site Scripting Vulnerability
HP UCMDB Foundation Software is able to provide users with bottom-up capabilities that include four parts: infrastructure auto-discovery, data modeling, service mapping definition and service impact analysis. A cross-site scripting vulnerability exists in HP UCMDB Foundation Software, which could...
The vulnerability of LiteSpeed web application server’s software lies in the lack of protection for operational data, allowing attackers to obtain confidential information.
The vulnerability of LiteSpeed web application server software lies in the lack of protection for service data. This allows attackers to access content from random memory segments such as random parts of HTTP requests sent to the server earlier. Exploiting this vulnerability can enable remote...
WEM Profile Settings are very delayed in applying to an end user session
WEM Profile Settings are very delayed in applying to an end user sessions...
CVE-2017-14616
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login...
CVE-2017-13761
The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses...
Adobe RoboHelp for Windows Cross-Site Scripting Code Vulnerability
Adobe RoboHelp for Windows is a set of professional authoring tools for the Windows-based platform. Adobe RoboHelp for Windows suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...
CVE-2017-12225
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...
CVE-2017-12225
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...
Why RDP Connections To Citrix VDA Consume Citrix Connection Licenses?
NOTE: This only applies to on-prem CVAD deployments. This behavior does not apply to CVAD service. Q. Even if there is no ICA session established on CitrixVDA and only RDP session is established, still Citrix Client License is consumed. A. This is an expected behavior. When we install a VDA, it...
CrushFTP Cross-Site Scripting Vulnerability
CrushFTP is a cross-platform Java FTP server . CrushFTP suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when malicious dat...
IBM Sametime Session Enumeration Vulnerability
IBM Sametime is a suite of next-generation social communication tools from IBM in the United States. The tool helps users realize real-time business collaboration by integrating audio voice, data and video. A security vulnerability exists in IBM Sametime versions 8.5.2 and 9.0. An attacker could...
CVE-2015-5209
Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object...
Design/Logic Flaw
Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object...
CVE-2015-5209
Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object...
Session fixation
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2017-12965
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2017-12965
Apache2Triad v1.5.4 on Windows is affected by CVE-2017-12965, a session-fixation vulnerability that allows remote attackers to hijack web sessions via the PHPSESSID parameter. Descriptions across sources (NVD/CNVD) consistently identify Session Fixation as the issue; exploit details are not provi...