4208 matches found
Open redirect
OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service connection blocking by keeping a connection open...
oclHashcat v1.2 - GPGPU-based Multi-hash Cracker
oclHashcat is a GPGPU-based multi-hash cracker using a brute-force attack implemented as mask attack, combinator attack, dictionary attack, hybrid attack, mask attack, and rule-based attack. This GPU cracker is a fusioned version of oclHashcat-plus and oclHashcat-lite. GPU Driver requirements: NV...
CVE-2014-0214
login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...
CVE-2014-3274
Cisco TelePresence System CTS 6.0.55 and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager UCM to...
SSH key cloning problem in OnApp templates
OnApp sells a "complete IaaS platform" for hosting providers to offer virtual servers. Their platform ships with templates disk images for many different operating systems, which it automatically customizes passwords, network settings, etc. when a new virtual server is deployed. During each...
CVE-2014-0090
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...
Session fixation
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...
AlienVault OSSIM SQL Injection / Code Execution
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "AlienVault OSSIM SQL Injection and Remote Code Execution", 'Description' = %q This module exploits an unauthenticated SQL injection...
C2FO: All Active user sessions should be destroyed when user change his password!
Hello, There is an user sessions issue on your application that should be fixed. Proof of Concept ------------------------ Suppose, you have an account on C2FO app.c2fo.com. Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromise...
Session fixation
Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID...
CVE-2013-7302
Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID...
RelateIQ: Old Sessions remain valid after the password change.
Industry Standard Procedure When the password is changed or email address has been updated for any particular account,all the sessions which were active with the old password/email should be destroyed. Reason If somehow anybody hacked into your account and you understand that someone has trespass...
HackerOne: All Active user sessions should be deleted when user change his password!
When a user changed his/her password either directly or with reset password flow, existing sessions were kept active. We already invalidate all sessions when a user logs out, but we were not doing the same for password changes. This means that if an attacker were to get access to an account, even...
CVE-2012-5036
Cisco IOS before 12.250SY1 allows remote authenticated users to cause a denial of service memory consumption via a sequence of VTY management sessions aka exec sessions, aka Bug ID CSCtn43662...
Code injection
Cisco IOS before 12.250SY1 allows remote authenticated users to cause a denial of service memory consumption via a sequence of VTY management sessions aka exec sessions, aka Bug ID CSCtn43662...
CVE-2012-5036
Cisco IOS before 12.250SY1 allows remote authenticated users to cause a denial of service memory consumption via a sequence of VTY management sessions aka exec sessions, aka Bug ID CSCtn43662...
CVE-2014-2341
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
Session fixation
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2014-2341
CubeCart prior to version 5.2.9 is vulnerable to a session-fixation flaw where an attacker can hijack a user session via the PHPSESSID parameter. The vulnerability stems from inadequate session protection (the only guard referenced is the User-Agent header in 5.2.8); PoCs show manipulating the PH...