CVE-2015-3216

CVE-2015-3216: Race condition in the PRNG lock (ssleay_rand_bytes) in OpenSSL (openssl-1.0.1e-25.el7 in Red Hat RHEL 7 and similar) can cause remote DoS by exhausting threads through many TLS sessions, potentially triggering a segfault. Connected docs corroborate OpenSSL involvement and related a...

IBM WebSphere MQ Information Disclosure Vulnerability

IBM WebSphere MQ is a messaging middleware product from IBM, USA. The product focuses on providing reliable and proven messaging for Service Oriented Architecture SOA. An information disclosure vulnerability exists in versions of IBM WebSphere MQ prior to 8.0.0.3. Allows remote attackers to obtai...

WordPress Salient theme cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, the platform supports personal blog sites on servers with PHP and MySQL.Salient is a work display theme. The WordPress Salient theme suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the...

IBM Security QRadar Incident Forensics Cross-Site Scripting Vulnerability

IBM Security QRadar Incident Forensics is a suite of security forensic investigation software. A cross-site scripting vulnerability in IBM Security QRadar Incident Forensics allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain...

OpenStack Horizon Cross-Site Scripting Vulnerability

OpenStack is a cloud platform management project.Horizon is a dashboard project that provides users and administrators with a Web-based user interface for managing OpenStack services. A cross-site scripting vulnerability exists in OpenStack Horizon, which allows remote attackers to exploit the...

SAP HANA Encryption Vulnerabilities

SAP’s in-memory relational database management system, HANA, contains a whopper of a security weakness: a default encryption key guarding passwords, stored data and backups. Researchers from ERPScan, which recently uncovered serious configuration vulnerabilities in Oracle PeopleSoft products, on...

Cacti Cross-Site Scripting Vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools. Cacti suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

Adobe Connect Cross-Site Scripting Vulnerability

Adobe Connect is an enterprise web conferencing solution. A cross-site scripting vulnerability exists in Adobe Connect, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions whe...

Drupal Webform module cross-site scripting vulnerability (CNVD-2015-03861)

Drupal is a free and open source content management system developed in PHP. webform is a market research questionnaire module. A cross-site scripting vulnerability exists in the Drupal Webform module processing node header, which allows remote attackers to exploit the vulnerability to inject...

Design/Logic Flaw

The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack...

Shopify: Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS

If an owner or an administrator clicks "Expire User Sessions" in Admin Site although you get the notification that all users where logged out, but this does not actually happens for the user that is currently logged in using the Shopify Application in IOS This was tested on the latest Shopify app...

ZOHO NetFlow Analyzer Cross-Site Scripting Vulnerability

ZOHO NetFlow Analyzer is a set of network traffic analysis software. The software provides bandwidth monitoring and flow analysis, network forensics and security analysis. ZOHO NetFlow Analyzer suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the...

Eliacom Enhanced SQL Portal 'iframe.php' Cross-Site Scripting Vulnerability

Eliacom Enhanced SQL Portal is a database management system. A cross-site scripting vulnerability in Eliacom Enhanced SQL Portal allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...

Cisco FireSIGHT System Software Cross-Site Scripting Vulnerability

The Cisco FireSIGHT Management Center centrally manages the network security and operational functions of Cisco ASA and Cisco FirePOWER Network Security Appliances with FirePOWER Services. Multiple cross-site scripting vulnerabilities in the management web interface of the Management Center...

Code injection

Beckwith Electric M-6200 Digital Voltage Regulator Control with firmware before D-0198V04.07.00, M-6200A Digital Voltage Regulator Control with firmware before D-0228V02.01.07, M-2001D Digital Tapchanger Control with firmware before D-0214V01.10.04, M-6283A Three Phase Digital Capacitor Bank...

Vulnerability in Moodle 'message/index.php'

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in the Moodle 'message/index.php' script. Due to the program failing to properly check the...

Fedora 20 : pcs-0.9.115-3.fc20 (2015-8761)

Fix for CVE-2015-1848, CVE-2015-3983 sessions not signed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

Fedora 22 : pcs-0.9.139-4.fc22 (2015-8765)

Fix for CVE-2015-1848, CVE-2015-3983 sessions not signed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

CVE-2014-8391

The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive information from other users' sessions via a large number of requests...

CVE-2014-0999

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header...