CVE-2014-2047

CVE-2014-2047 affects ownCloud Server prior to 6.0.2, where PHP may accept session parameters via GET. The root cause is that authentication could proceed without invalidating an existing session, enabling an attacker to hijack a user’s session (session fixation). The linked advisories describe t...

Ubuntu Update for tomcat7 USN-2130-1

Check for the Version of tomcat7 OpenVAS Vulnerability Test $Id: gbubuntuUSN21301.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for tomcat7 USN-2130-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...

Ubuntu: Security Advisory (USN-2130-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2130-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled certain inconsistent HTTP headers. A remote attacker could possibly use this flaw to conduct request smuggling attacks. CVE-2013-4286 It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A...

Java OpenID Server 1.2.1 XSS / Session Fixation

Hi, This is a public disclosure with disarmed Proof of Concept of unpatched vulnerabilities in JOIDS Java OpenID Server. "JOIDS Java OpenID Server is a multi-domain, multi-user OpenID Provider based on OpenID4Java, Spring Framework, Hibernate, Velocity" https://code.google.com/p/openid-server/...

Slack: Session Fixation disclosing email address

Desc: Session fixation occurs due to SessionID in URL. A valid session-URL should be only a one time use. In this case a valid session-URL remains active for infinite time. The browser/cache may store this unique Session-URL and disclose EMAIL address of the user. Working: 1Register 2One...

[SECURITY] CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 6.0.33 to 6.0.37 Description: Previous fixes to path parameter handling 1 introduc...

Apache Tomcat会话固定漏洞

Bugtraq ID:65769 CVE ID:CVE-2014-0033 Apache Tomcat是一款开放源码的JSP应用服务器程序。 由于对路径参数处理的修复引入的回溯，即使在启用disableURLRewriting的情况下也可导致一个会话固定攻击，允许远程攻击者利用漏洞未授权访问应用。 0 Apache Tomcat 6.0.0 - 6.0.37 厂商补丁： Apache ----- Apache Tomcat 6.0.39已经修复该漏洞，建议用户下载更新： http://tomcat.apache.org/...

CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

Session fixation

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

CVE-2014-0033

CVE-2014-0033 affects Apache Tomcat 6.0.33–6.0.37, where the disableURLRewriting setting is not honored when a session ID is in a URL. This could allow remote attackers to hijack a valid user’s session via a crafted link. The vulnerability is documented in IBM advisories and the GHSA entry, which...

CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

UBUNTU-CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

Oracle Secure Global Desktop Multiple Vulnerabilities (January 2014 CPU)

The remote host has a version of Oracle Secure Global Desktop installed that is affected by multiple vulnerabilities : - Specially crafted requests sent with chunked transfer encoding could allow a remote attacker to perform a 'limited' denial of service attack on the Tomcat server. CVE-2012-3544...

JBoss Portal 6.1.0 Update (RHSA-2013:1437)

The version of JBoss Enterprise Portal Platform on the remote system is affected by the following issues: - A flaw in CSRF prevention filter in JBoss Web could allow remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...

NEW VMSA-2013-0012 VMware vSphere updates address multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2013-0012 Synopsis: VMware vSphere updates address multiple vulnerabilities Issue date: 2013-10-17 Updated on: 2013-10-17 initial...

CVE-2013-5426

Session fixation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 IF5 and 11.0 before IF1 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 IF11 allows remote authenticated users to hijack web sessions via...

Session fixation

Session fixation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 IF5 and 11.0 before IF1 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 IF11 allows remote authenticated users to hijack web sessions via...

CVE-2013-5426

CVE-2013-5426 affects IBM InfoSphere Master Data Management - Collaborative Edition (11.0, 10.1, 10.0) and IBM InfoSphere Master Data Management Server for Product Information Management (9.0, 9.1). The issue is a session-fixation vulnerability that could allow an authenticated attacker to hijack...