OddJob Trojan Piggybacks On Legitimate eBanking Sessions

A new Trojan leads online banking customer into thinking they have logged out of their sessions when in fact they remain logged in. Discovered by Trusteer researchers, this completely new piece of malware represents the evolution of online attacks in the ways in which it integrates new and old...

CVE-2011-1067

slapd aka ns-slapd in 389 Directory Server before 1.2.8.a2 does not properly manage the ctimelimit field of the connection table element, which allows remote attackers to cause a denial of service daemon outage via Simple Paged Results connections, as demonstrated by using multiple processes to...

Ubuntu Update for qemu-kvm vulnerability USN-1063-1

Ubuntu Update for Linux kernel vulnerabilities USN-1063-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10631.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for qemu-kvm vulnerability USN-1063-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH,...

CVE-2011-0584

Session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to hijack web sessions via unspecified vectors...

Session fixation

Session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2011-0584

CVE-2011-0584 refers to a session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 . The issue allows remote attackers to hijack web sessions via unspecified vectors, indicating an authentication/session management weakness that persists across affected ColdFusion versions. The vulner...

Design/Logic Flaw

The web management portal on the SMC SMCD3G-CCR aka Comcast Business Gateway with firmware before 1.4.0.49.2 uses predictable session IDs based on time values, which makes it easier for remote attackers to hijack sessions via a brute-force attack on the userid cookie...

AST-2011-001: Stack buffer overflow in SIP channel driver

Asterisk Project Security Advisory - AST-2011-001 Product Asterisk Summary Stack buffer overflow in SIP channel driver Nature of Advisory Exploitable Stack Buffer Overflow Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On January 11, 2011 Reported By...

CVE-2010-4499

Session fixation vulnerability in Collaborative Information Manager server, as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1, allows remote attackers to hijack web sessions via unspecified vectors...

Session fixation

Session fixation vulnerability in Collaborative Information Manager server, as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1, allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2010-4499

Session fixation vulnerability in Collaborative Information Manager server, as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1, allows remote attackers to hijack web sessions via unspecified vectors...

PT-2011-1647 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA 5500 series devices versions prior to 8.32 Description: The issue allows remote attackers to cause a denial of service, resulting in a device crash. This can be achieved by establishing a large number of...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

JBoss EAP jmx console FileDeployment CSRF

Cross-site request forgery CSRF vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files...

CVE-2010-4172

Multiple cross-site scripting XSS vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the 1 orderBy or 2 sort parameter to sessionsList.jsp, or unspecified input to 3...

PT-2010-5335 · Apache +1 · Apache Tomcat +1

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 6.0.12 through 6.0.29 Apache Tomcat versions 7.0.0 through 7.0.4 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the orderBy or sort parameters to "sessionsList.jsp", or...

WebKit - Insufficient Entropy Random Number Generator (1)

source: https://www.securityfocus.com/bid/44952/info WebKit is prone to a random-number-generator weakness. Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage. Successful attacks will allow attackers to track user sessions and obtain personal...

CVE-2010-3892

Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID aka SID value...

Session fixation

Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID aka SID value...

CVE-2010-3892

Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID aka SID value...