CVE-2012-4935

CVE-2012-4935 : Pattern Insight 2.3 web interface contains a Cross-Site Request Forgery (CSRF) vulnerability that can allow an authenticated user to be coerced into performing actions of the attacker’s choosing. The NVD entry lists a base score of 6.8 (Medium) with network attack vector, no user ...

CVE-2012-4936: Undefined Security Weakness

The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element...

CVE-2012-4935: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2012-4937: Undefined Security Weakness

Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsessionid cookie...

CVE-2012-4938: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message...

CVE-2012-4950: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during construction of error messages...

PT-2012-5671

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3 Description The issue allows remote attackers to hijack web sessions. This is achieved via a jsession id cookie in the web interface. Recommendations For Pattern Insight version 2.3, update to a version that fixes...

PT-2012-5672

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3 Description A cross-site scripting XSS issue exists in the web interface, allowing remote authenticated administrators to inject arbitrary web script or HTML via the banner message. This could potentially lead to...

PT-2012-5669

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3 Description A cross-site request forgery CSRF issue in the web interface allows remote attackers to hijack the authentication of arbitrary users. Recommendations For version 2.3, update to a version that includes a...

PT-2012-5684

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3 Description A cross-site scripting XSS issue exists in the Keyword Search page of the web interface, allowing remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly...

PT-2012-5670

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3 Description The issue allows remote attackers to conduct clickjacking attacks via a FRAME element in the web interface. Recommendations For Pattern Insight version 2.3, consider disabling the web interface or...