4206 matches found
INN: Man-in-the-middle attack
Background INN is a news server which can interface with Usenet. Description INN’s I/O buffering is not correctly restricted. Impact A remote attacker could inject commands into encrypted NNTP sessions. Workaround There is no known workaround at this time. Resolution All INN users should upgrade ...
Design/Logic Flaw
IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for IT 6.0.1.5 and earlier and 6.0.2, and Global Retention Policy and Schedule Management 6.0.1.5 and earlier and 6.0.2 in IBM Atlas Suite aka Atlas Policy Suite do not properly validate...
Siemens Fixes Authentication Bugs in Scalance X-200 Switches
Researchers have discovered two serious vulnerabilities in industrial Ethernet switches manufactured by Siemens that could enable attackers to perform unauthorized actions on the switches without authentication. One of the bugs allows attackers to hijack Web sessions and the other enables them to...
[FoxAnalysis] Firefox Internet History Analysis Software
FoxAnalysis Plus is a software tool for extracting, viewing and analysing internet history from the Mozilla Firefox web browser. The main features are described below: Extract History :: Extract history regarding bookmarks, cookies, downloads, favicons, form entries, logins, saved sessions and...
AST-2013-007: Asterisk Manager User Dialplan Permission Escalation
Asterisk Project Security Advisory - AST-2013-007 Product Asterisk Summary Asterisk Manager User Dialplan Permission Escalation Nature of Advisory Permission Escalation Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known None Reported On November 25, 2013 Reported By Matt...
FlashCanvas 'proxy.php'跨站脚本漏洞
Bugtraq ID:64251 CVE ID:CVE-2013-6880 FlashCanvas是一个JavaScript库，可使Internet Explorer支持HTML5 Canvas。 FlashCanvas 'proxy.php'脚本不充分校验Referer Header数据，允许远程攻击者利用漏洞提交特制的GET请求，可获取敏感信息或劫持用户会话。 0 FlashCanvas 1.5 厂商补丁： FlashCanvas ----- FlashCanvas 1.6已经修复该漏洞，请到厂商的主页下载： http://flashcanvas.net/...
Session fixation
Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie...
CVE-2013-6634
The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/oneclicksigninhelper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper...
Session fixation
The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/oneclicksigninhelper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper...
CVE-2013-6634
Removed by vendor...
CVE-2013-6634
The CVE-2013-6634 issue affects Chromium/ chromium-browser prior to version 31.0.1650.63, where OneClickSigninHelper::ShowInfoBarIfPossible used an incorrect URL during realm validation. This allowed session fixation and potential web-session hijacking via a 302 redirect. The documented fixes upg...
CVE-2013-6004
Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors...
Session fixation
Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors...
CVE-2013-6004
Summary: CVE-2013-6004 describes a session fixation vulnerability in Cybozu Garoon version before 3.7.2. An unauthenticated remote attacker could impersonate a registered user and hijack web sessions via unspecified vectors. Affected software: Cybozu Garoon 3.7 (and earlier) as indicated by JVN/N...
CVE-2013-6004
Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors...
Updated lighttpd packages fix multiple security vulnerbilities
Updated lighttpd packages fix security vulnerabilities: lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the...
CVE-2013-4508
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network...
Information disclosure
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network...
CVE-2013-4508
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network...