IBM Cognos Command Center会话固定漏洞

Bugtraq ID:64267 CVE ID:CVE-2013-4001 IBM Cognos是一款集成商业智能（BI）和计划的解决方案。 IBM Cognos Command Center存在一个会话固定漏洞，允许远程攻击者利用漏洞劫持用户会话，未授权访问应用。 0 IBM Cognos Command Center 10.1 厂商补丁： IBM ----- IBM Cognos Command Center 10.2已经修复该漏洞，请到厂商相关页面下载： http://www.ibm.com/support/docview.wss?uid=swg24035464...

CVE-2013-4001

Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in IBM Cognos Command Center before 10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 start or 2 stop services...

Session fixation

Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie...

CVE-2013-4001

Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie...

CVE-2013-3979

Multiple cross-site scripting XSS vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center aka Star Command Center or Star Analytics before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML vi...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center aka Star Command Center or Star Analytics before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2013-3979

CVE-2013-3979: Multiple XSS vulnerabilities in the Web Client’s help pages (Web\Content\Help) of IBM Cognos Command Center (Star Command Center/Star Analytics) prior to version 10.1, triggered when using Internet Explorer. Exploitation is via unspecified vectors by remote authenticated users; imp...