4600 matches found
CVE-2015-8124
The CVE-2015-8124 vulnerability affects Symfony’s Remember Me feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7, allowing remote attackers to hijack sessions via a session ID. The issue is a session fixation flaw that enables impersonation of users when the remem...
CVE-2015-8124
Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id...
When WSCReconnectMode Value 8 is Set a Windows Logoff and Logon Happens, Existing Sessions Should Reconnect Automatically
When WSCReconnectMode value 8 is set the existing session does not reconnect on logon. The expected behavior is on logon the session will reconnect...
Moodle cross-site scripting vulnerability (CNVD-2015-07728)
Moodle is a free, open source e-learning software platform. Moodle suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...
Updated dovecot packages fix security vulnerability
A buffer overflow may occur when handling pop3deletedflag setting. This can lead to crashing POP3 sessions in normal use...
MGASA-2015-0452 Updated dovecot packages fix security vulnerability
A buffer overflow may occur when handling pop3deletedflag setting. This can lead to crashing POP3 sessions in normal use...
Moderate: Red Hat Bug Fix Advisory: samba bug fix and enhancement update
Updated samba packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol, which allow PC-compatible machines...
MediaWiki cross-site scripting vulnerability (CNVD-2015-07394)
MediaWiki is a suite of free and freely available web-based wiki engines that can be used to deploy in-house knowledge management and content management systems. MediaWiki suffers from a cross-site scripting vulnerability that could be exploited by remote attackers to inject malicious script or...
GLSA-201510-06 : Django: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201510-06 Django: Multiple vulnerabilities Multiple vulnerabilities have been found in Django: Session backends create a new record anytime request.session was accessed CVE-2015-5143 Built-in validators in Django do not properly...
WordPress User List Table Cross-Site Scripting Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. WordPress fails to adequately filter user-submitted input, allowing remote attackers to exploit vulnerabilities to inject malicious scripts or HTML code that can capture sensitive...
Revive Adserver Unauthorized Operation Vulnerability
Revive Adserver is an open source ad management system from the Revive Adserver team. A security vulnerability in Revive Adserver versions prior to 3.2.2 can be exploited by remote attackers to perform restricted operations with the help of unexpired sessions established by deleted or disconnecte...
python-django: Denial-of-service possibility in logout() view by filling session store
It was found that certain Django functions would, in certain circumstances, create empty sessions. A remote attacker could use this flaw to fill up the session store or cause other users' session records to be evicted by requesting a large number of new sessions...
CVE-2015-7367
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been 1 deleted or 2 unlinked...
Code injection
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been 1 deleted or 2 unlinked...
The vulnerability of the NX-OS network operating system allows a hacker to induce a maintenance failure.
The vulnerability of the NX-OS network operating system’s banner implementation is related to resource management errors. Exploiting this vulnerability allows a malicious actor to remotely cause service failures by manipulating requests to establish Telnet sessions...
python-django: Denial-of-service possibility in logout() view by filling session store
It was found that Django incorrectly handled the session store. A session could be created by anonymously accessing the django.contrib.auth.views.logout view if it was not decorated correctly with django.contrib.auth.decorators.loginrequired. A remote attacker could use this flaw to fill up the...
CVE-2015-2029
Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier...
Session fixation
Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier...
CVE-2015-2029
IBM WebSphere eXtreme Scale 7.1.0 (before 7.1.0.3) and 7.1.1 (before 7.1.1.1) expose a session fixation vulnerability that allows remote attackers to hijack a user’s web session by exploiting an existing session identifier. The issue stems from improper session management (failure to invalidate o...