PT-2017-16884

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 1.0.4 Zammad versions 1.1.x prior to 1.1.3 Zammad versions 1.2.x prior to 1.2.1 Description A CSRF issue was discovered. To exploit the issue, an attacker can send cross-domain requests directly to the REST API for use...

PT-2017-17338

Name of the Vulnerable Software and Affected Versions mod auth mellon versions prior to 0.13.1 Description The issue allows a user with access to one web site running on a server to copy their session cookie to a different web site on the same server, thereby gaining access to that site. This is...

CVE-2017-6807: Improper Neutralization of Input During Web Page Generation

modauthmellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site...

WatchGuard XTMv 11.12 Build 516911 - User Management Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications !-- KL-001-2017-004 : WatchGuard XTMv User Management Cross-Site Request Forgery Title: WatchGuard XTMv User Management Cross-Site Request Forgery Advisory ID: KL-001-2017-004 Publication Date: 2017.03.10 Publication URL:...

WatchGuard XTMv 11.12 Build 516911 - User Management Cross-Site Request Forgery

!-- KL-001-2017-004 : WatchGuard XTMv User Management Cross-Site Request Forgery Title: WatchGuard XTMv User Management Cross-Site Request Forgery Advisory ID: KL-001-2017-004 Publication Date: 2017.03.10 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-004.txt 1...

CVE-2016-9344

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files...

CVE-2016-9344

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files...

Design/Logic Flaw

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files...

CVE-2016-9344

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files...

PT-2017-10074

Name of the Vulnerable Software and Affected Versions Moxa MiiNePort E1 versions prior to 1.8 Moxa MiiNePort E2 versions prior to 1.4 Moxa MiiNePort E3 versions prior to 1.1 Description An issue allows an attacker to potentially brute force an active session cookie, enabling them to download...

CVE-2016-9344: Insertion of Sensitive Information into Log File

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files...

Zoneminder 1.29 / 1.30 CSRF / XSS / SQL Injection / Session Fixation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 === FOXMOLE - Security Advisory 2016-07-05 === Zoneminder multiple vulnerabilities Affected Versions ================= Zoneminder 1.29,1.30 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Session Fixation, No...

CVE-2016-5958

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture...

CVE-2016-5958

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture...

Design/Logic Flaw

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture...

CVE-2016-5958: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture...

PT-2017-8832

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager affected versions not specified Description The issue is caused by the failure to set the secure flag for the session cookie in SSL mode, allowing a remote attacker to obtain sensitive information by...

e107 2.1.2 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications e107 Content Management System CMS - Multiple Issues Affected Versions ================= e107 2.1.2 Bootstrap CMS Issue Overview ============== Vulnerability Type: Multiple Vulnerabilities Technical Risk: medium Likelihood of Exploitation:...

e107 2.1.2 Cross Site Request Forgery / Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 === FOXMOLE - Security Advisory 2016-05-02 === e107 Content Management System CMS - Multiple Issues Affected Versions ================= e107 2.1.2 Bootstrap CMS Issue Overview ============== Vulnerability Type: Multiple Vulnerabilities Technical Ris...

CVE-2016-0353

IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...