2894 matches found
CVE-2014-4692: Exposure of Sensitive Information to an Unauthorized Actor
pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...
CVE-2014-2509
Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...
Session fixation
Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...
XFree86 X11R6 3.3 XDM Session Cookie Guessing Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2985/info xdm is the X Display Manager, a component of the XFree86 package. xdm manages the display of X sessions both locally and remotely. An xdm server compiled without WrapHelp.c is vulnerable to a brute force X cooki...
MaxWebPortal 1.30 search.asp Search Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/7837/info A number of vulnerabilities have been discovered in the MaxWebPortal. The issues that have been discovered include: MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An...
Citrix Nfuse 1.6 Published Applications Information Leak Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3926/info Citrix Nfuse is an application portal server meant to provide the functionality of any application on the server via a web browser. Nfuse works in conjunction with a previously-installed webserver. If a request...
CTERA 3.2.29.0 and 3.2.42.0 - Stored XSS
No description provided by source. 恶意用户可以修改项目文件夹描述进行XSS攻击和HTML注入（添加链接、图片和按钮等）。 因为项目文件夹时被不同用户共享，该漏洞可以用来抓取会话cookie。 创建一个项目文件夹并添加下面的描述（根据版本修改特定路径）：...
CVE-2014-2509
Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...
Novell eDirectory 8.8.5 DHost Weak Session Cookie Session Hijacking Vulnerability
source: http://www.securityfocus.com/bid/38782/info Novell eDirectory is prone to a session-hijacking vulnerability. An attacker can exploit this issue to gain access to the affected application. Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected. $Id:...
Ruby on Rails Known Secret Session Cookie Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
ASP Portal Multiple Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/9659/info ASP Portal has been reported to be prone to multiple vulnerabilities. The first issue results from a lack of sufficient sanitization performed on user supplied data that is later incorporated into dynamic conten...
CVE-2014-2509
CVE-2014-2509 describes a session-fixation vulnerability in the EMC Network Configuration Manager (NCM) , specifically within the Report Advisor (RA) component. The issue would allow an attacker to hijack a NCM web session by manipulating the session cookie, affecting the RA prior to version 9.3 ...
MaxWebPortal 1.30 Remote Database Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/7837/info A number of vulnerabilities have been discovered in the MaxWebPortal. The issues that have been discovered include: MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An...
openSUSE Security Update : webyast (openSUSE-SU-2013:1961-1)
Fixed CVE-2013-3709: make the secret token file secrettoken.rb readable only for the webyast user to avoid forging the session cookie bnc851116 reported by joernchen of Phenoelit %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
openSUSE Security Update : webyast (openSUSE-SU-2013:1954-1)
Fixed CVE-2013-3709: make the secret token file secrettoken.rb readable only for the webyast user to avoid forging the session cookie bnc851116 reported by joernchen of Phenoelit %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
CVE-2012-6142
Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized...
Design/Logic Flaw
Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized...
PT-2014-2375
Name of the Vulnerable Software and Affected Versions HTML::EP module versions 0.2011 Description The issue arises from the improper use of the Storable::thaw function in the Session::Cookie component of the HTML::EP module for Perl. This allows remote attackers to execute arbitrary code via a...
PT-2014-2374
Name of the Vulnerable Software and Affected Versions App::Context versions 0.01 through 0.968 Description The issue arises from the improper use of the Storable::thaw function in the App::Context module for Perl. This allows remote attackers to execute arbitrary code via a crafted request to API...
CVE-2012-6141: Improper Control of Generation of Code
The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request to 1 App::Session::Cookie or 2 App::Session::HTMLHidden, which is not properly handled when it is deserialized...