APPLE-SA-2015-09-21-1 watchOS 2

APPLE-SA-2015-09-21-1 watchOS 2 watchOS 2 is now available and addresses the following: Apple Pay Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: Some cards may allow a terminal to retrieve limited recent transaction information when making a payment Description: Th...

Session fixation

IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

ownCloud: apps.owncloud.com: SSL Session cookie without secure flag set

URL: https://apps.owncloud.com/usermanager/login.php Issue detail The following cookie was issued by the application and does not have the secure flag set: PHPSESSID=27caghhkfjvuso3mmiqajqt2n4; path=/; HttpOnly The cookie appears to contain a session token, which may increase the risk associated...

Multiple Blue Coat Systems SSL Visibility Appliance Product Information Disclosure Vulnerabilities

Blue Coat Systems SSL Visibility Appliance SV800 and others are SSL visibility appliances from Blue Coat Systems, USA, which are at the heart of encrypted traffic management, providing visibility into SSL traffic and supporting the addition of SSL inspection capabilities to advanced threat...

Design/Logic Flaw

The pcs daemon pcsd in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerabili...

CVE-2014-6153

The Web UI in IBM WebSphere Service Registry and Repository WSRR 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture...

Design/Logic Flaw

McAfee Network Data Loss Prevention NDLP before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

Medium: curl

Issue Overview: libcurl wrongly allows cookies to be set for TLDs, thus making them much broader then they are supposed to be allowed to. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain. By not detecting and rejecting domain names...

cumin: session cookies lack httponly setting

It was found that Cumin did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

Web Slider <= 0.6 Insecure Cookie/Authentication Handling Vuln

No description provided by source. --==+================================================================================+==-- --==+ Web Slider = 0.6 Insecure Cookie/Authentication Handling +==-- --==+================================================================================+==-- Discovered...

CVE-2013-4725

CVE-2013-4725 affects DDSN Interactive cm3 Acora CMS versions 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1 (and possibly others). Description: the CMS does not set the Secure flag on an unspecified cookie in HTTPS sessions, allowing an attacker to capture the cookie by intercepting its transmission...

X (Formerly Twitter): Cookie not marked as secure.

Ehy, I have found a bug in twitter site but isn't in scope the site but I have decided to report because I think that you will consider it at our discretion! Only hope for the hall of fame The site is from Twitter inc I have check it with whois: investor.twitterinc.co Issue: Cookie not marked as...

Session fixation

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Weak randomization seeds of vulnerability science-vulnerability warning-the black bar safety net

0x00 background Last week I attended a Bishop Fox and the BYU University organized CTF game, during the race I decided to try out the invasion about the scoring system, and I took intrusion of the recording process down. Although the client token cheat is not nothing new, but this time the invasi...

Nisuta NS-WIR150NE / NS-WIR300N Authentication Bypass

Nisuta NS-WIR150NE, NS-WIR300N Wireless Routers Remote Management Web Interface Authentication Bypass Vulnerability Amplia Security - Amplia Security Research Advisory AMPLIA-ARA050913 Advisory ID: AMPLIA-ARA050913 Advisory URL: Date Published: 12-26-2013 Vendors Contacted: Nisuta www.nisuta.com...

CVE-2013-4617

CVE-2013-4617 affects Jahia xCM prior to 6.6.2. The issue is that the Set-Cookie header for the JSESSIONID cookie does not use the HTTPOnly flag, which can allow remote attackers to access the cookie via client-side scripts and potentially expose sensitive information. The provided documents conf...

Fedora 17 : curl-7.24.0-9.fc17 (2013-7797)

switch SSL socket into non-blocking mode after handshake 960765 - prevent an artificial timeout event due to stale speed-check data 906031 - show proper host name on failed resolve 957173 fix cookie tailmatching to prevent cross-domain leakage CVE-2013-1944 Note that Tenable Network Security has...

Hloun Support Management System 3.0 SQL Injection / Bypass

Hloun Support Management System version 3.0 suffers from authentication bypass and remote SQL injection vulnerabilities. fixhashuser$COOKIE'onlineadmin'; $userquery = "SELECT FROM member WHERE username='".$memberhash'username'."' AND password='".$memberhash'password'."'"; $member =...

CVE-2013-1944

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL...

[SECURITY] [DSA 2660-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2660-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 20, 2013 http://www.debian.org/security/faq -...