httpd: Padding Oracle in Apache mod_session_crypto

It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...

PT-2015-7671

Name of the Vulnerable Software and Affected Versions eWON devices versions prior to 10.1s0 Description The issue allows remote attackers to obtain access by leveraging an unattended workstation, due to the failure of the device to discard browser session data after a log-off action...

CVE-2015-7924: Undefined Security Weakness

eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...