Fedora 19 : php-5.5.16-1.fc19 (2014-9679)

21 Aug 2014, PHP 5.5.16 Core : - Fixed bug 67693 incorrect push to the empty array Tjerk - Fixed bug 67717 segfault in dnsgetrecord. CVE-2014-3597 Remi COM : - Fixed missing type checks in comeventsink Yussuf Khalil, Stas. Fileinfo : - Fixed bug 67705 extensive backtracking in rule regular...

Cisco Intelligent Automation for Cloud iFrame Vulnerability

A vulnerability in Cisco Intelligent Automation for Cloud could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability is due to a failure to properly check for certain NULL sessions. An attacker could exploit this vulnerability by submitting crafted packets to...

Cisco Intelligent Automation for Cloud Enumeration Vulnerability

A vulnerability in Cisco Intelligent Automation for Cloud could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability is due to a failure to properly check for certain NULL sessions. An attacker could exploit this vulnerability by submitting crafted packets to...

CVE-2014-0482

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

PYSEC-2014-6

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

CVE-2014-0482

CVE-2014-0482 affects Django where RemoteUserMiddleware with RemoteUserBackend lets remote authenticated users hijack sessions via the REMOTE_USER header. Affected versions: Django before 1.4.14; 1.5.x before 1.5.9; 1.6.x before 1.6.6; 1.7 before RC3. Root cause: lack of proper logout/login handl...

CVE-2014-0482

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

CVE-2014-0482

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

Concrete CMS: broken authentication

Hello, Steps to Replicate:- 1 Create a concrete5 account. 2 request a Password Reset link in Email don't use it 3 Login with the Desired Password 4 Change the Password Several Times From Settings This destroys all the Active Sessions in my case i've made upto 10 Password changes. 5 After several...

HackerOne: No option to logout concurrent sessions

Description When I login to Hackerone using two different computers I can easily browse the session concurrently . This means that if an attacker somehow knows password of user by any means he can login using that info and the main user will not get notified. FIX If someone else login to a accoun...

Authentication flaw

Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, which allows remote attackers to obtain sensitive information via RETR commands...

TYPO3 6.2.0 - 6.2.2 Multiple Vulnerabilities (TYPO3-CORE-SA-2014-001)

TYPO3 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; ifdescription...

CVE-2014-4691

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie...

Session fixation

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie...

CVE-2014-4691

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie...

Session fixation

Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...

Linux kernel 2.2 Predictable TCP Initial Sequence Number Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/670/info A vulnerability in the Linux kernel allows remote users to guess the initial sequence number of TCP sessions. This can be used to create spoofed TCP sessions bypassing some types of IP based access controls. The...

CuteNews 1.4.6 index.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...

Parallels PLESK 9.x - Insecure Permissions

No description provided by source. Exploit Title: PLESK 9.x insecure directory permission admin password revealed Date: 25/04/2012 Author: Nicolas Krassas , twitter.com/dinosn Software Link: www.parallels.com/plesk/ Version: 9.x Tested on: ubuntu / centos During backup procedures, PLESK panel is...

Zabbix 2.0.1 and Earlier Session Extractor 0day

No description provided by source. !/usr/bin/python import re import sys,urllib2,urllib print \n Zabbix 2.0.1 Session Extractor 0day print http://www.offensive-security.com print \n ''' The sessions found by this tool may allow you to access the scripts.php file. Through this web interface, an...