4058 matches found
Zoneminder 1.291.30 - Cross-Site Scripting SQL Injection Session Fixation Cross-Site Request Forgery
Zoneminder 1.291.30 - Cross-Site Scripting SQL Injection Session Fixation Cross-Site Request Forgery Source: https://www.foxmole.com/advisories/foxmole-2016-07-05.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 === FOXMOLE - Security Advisory 2016-07-05 === Zoneminder multiple vulnerabilities...
Zoneminder 1.29/1.30 - Cross-Site Scripting / SQL Injection / Session Fixation / Cross-Site Request Forgery
Source: https://www.foxmole.com/advisories/foxmole-2016-07-05.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 === FOXMOLE - Security Advisory 2016-07-05 === Zoneminder multiple vulnerabilities Affected Versions ================= Zoneminder 1.29,1.30 Issue Overview ============== Vulnerability...
Zoneminder 1.29 / 1.30 Multiple Vulnerabilities
Zoneminder versions 1.29 and 1.30 suffer from cross site request forgery, cross site scripting, session fixation, and remote SQL injection vulnerabilities. Zoneminder multiple vulnerabilities Affected Versions ================= Zoneminder 1.29,1.30 Issue Overview ============== Vulnerability Type...
Zoneminder 1.29 / 1.30 CSRF / XSS / SQL Injection / Session Fixation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 === FOXMOLE - Security Advisory 2016-07-05 === Zoneminder multiple vulnerabilities Affected Versions ================= Zoneminder 1.29,1.30 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Session Fixation, No...
Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Vulnerabilities
Revive Adserver versions 4.0.0 and below suffer from cross site scripting, session fixation, and deserialization of untrusted data vulnerabilities. Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Applications affected: Revive Adserver Versions affected: = 4.0.1 Website:...
Session fixation
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification...
CVE-2015-4594
eClinicalWorks Population Health CCMR suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID...
Session fixation
eClinicalWorks Population Health CCMR suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID...
CVE-2015-4594
CVE-2015-4594 affects eClinicalWorks Population Health CCMR Client Portal. The root cause is a missing new session ID upon user authentication, enabling session fixation by reusing an existing session ID. The vulnerability implies potential compromise of active sessions (high/critical impact per ...
CVE-2015-4594
eClinicalWorks Population Health CCMR suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID...
Session Fixation
clearance is vulnerable to session fixation attacks. These attacks are possible because the CSRF token is not rotated on sign in...
Gratipay: Session Fixation At Logout /Session Misconfiguration
Dear Suppport Team , Commonly After Logout time , session should destroy and then new session should be created .. But in your application , it is not possible and same sessioncookie is there before logout and after logout from your application . For further details please find the attachment...
Scientific Linux Security Update : pcs on SL7.x x86_64 (20161103)
The following packages have been upgraded to a newer upstream version: pcs 0.9.152. Security Fixes : - A Cross-Site Request Forgery CSRF flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would...
keycloak: account hijacking via auth code fixation
It was found that the keycloak did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks...
Session fixation
IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user's session...
CentOS 7 : pcs (CESA-2016:2596)
An update for pcs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
pcs security update
CentOS Errata and Security Advisory CESA-2016:2596 An update for pcs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Session fixation
IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...
RHEL 6 / 7 : Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7 (Important) (RHSA-2016:2807)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2807 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. This release of Red Hat JBoss Web Serve...
tomcat: Session fixation
A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests...