CVE-2010-3892

Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID aka SID value...

Session fixation

Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID aka SID value...

CVE-2010-3892

Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID aka SID value...

CVE-2010-3892

CVE-2010-3892: Session fixation in IBM OmniFind Enterprise Edition (admin interface login form) allows remote attackers to hijack sessions by replaying a server-generated session ID (SID). Affected: IBM OmniFind Enterprise Edition 8.x and 9.x. The provided connected docs confirm the vulnerability...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

BlackSheep Plugin Bites Back: Detecting FireSheep Hijack Attempts

With more than 600,000 copies of the FireSheep browser plug-in downloaded in a matter of weeks, Web security firm zScaler have released a new Firefox plug-in, BlackSheep, in hopes of combating attempts by those using FireSheep to try to hijack their Web session. The plug-in doesn’t protect users...

SAP NetWeaver Data Archiving Service — Multiple XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Data Archiving Service 6.4-7.3 Vendor URL: http://www.sap.com Bugs: Linked XSS and Stored XSS Exploits: YES Reported: 11.05.2010 Vendor response: 11.05.2010 Date of Public Advisory: 12.04.2011 Author: Dmitriy Evdokimov Description SAP...

[Get] USBsploit v0.4BETA ! Download

"USBsploit is a PoC to generate Reverse TCP backdoors, running Autorun or LNK USB infections, but also dumping all USB files remotely on multiple targets at the same time. USBsploit works through Meterpreter sessions with a light 27MB modified version of Metasploit." This version now supports PDF...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

Ubuntu Update for PostgreSQL vulnerability USN-1002-1

Ubuntu Update for Linux kernel vulnerabilities USN-1002-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10021.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for PostgreSQL vulnerability USN-1002-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

CVE-2010-3780

Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service master process outage by simultaneously disconnecting many 1 IMAP or 2 POP3 sessions...

SecTor

Toronto, Ontario, Canada Billed as “Canada’s Premiere IT Security Conference” they might want to ask the CanSecWest folks about that, SecTor is an annual security confab that draws some of the top security researchers and IT professionals from the Great White North and the U.S. to Toronto for...

Hack in the Box (HITB)

Kuala Lumpur, Malaysia Booked as “Asia’s Premier Deep Knowledge Security Conference,” HITB is in its 8th year and has since expanded into other countries in the Middle East and Europe. Modeled on shows like Black Hat, HITB offers both training sessions and a multi track security conference and...

Nmap NSE: SMB Enum Sessions

This script attempts to enumerate the users logged into a system either locally or through an SMB share. This is a wrapper on the Nmap Security Scanner's http://nmap.org smb-enum-sessions.nse. OpenVAS Vulnerability Test $Id: gbnmapsmbenumsessions.nasl 7006 2017-08-25 11:51:20Z teissa $ Wrapper fo...

Nmap NSE: SMB Enum Sessions

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-2811

Virtual Desktop Server Manager VDSM in Red Hat Enterprise Virtualization RHEV 2.2 does not properly accept TCP connections for SSL sessions, which allows remote attackers to cause a denial of service daemon outage via crafted SSL traffic...

Debian DSA-2089-1 : php5 - several vulnerabilities

Several remote vulnerabilities have been discovered in PHP 5, an hypertext preprocessor. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-1917 The fnmatch function can be abused to conduct denial of service attacks by crashing the interpreter by the...

Secure Administrator Sessions feature can be bypassed

In some circumstances an attacker may be able to craft a request to a Confluence server that bypasses the additional layer of security added by the new Secure Administrator Sessions feature introduced in Confluence 3.3. This would allow an attacker to perform administrative functions on Confluenc...

Enable Web Sudo to work with other single-sign-on solutions

Customers with some of the unsupported single sign-on solutions|http://confluence.atlassian.com/display/DEV/Single+Sign-on+Integration+with+JIRA+and+Confluence can't easily upgrade to Confluence 3.3 because WebSudo doesn't handle external SSO solutions. See this example:...