Apache Tomcat 6.0.x < 6.0.37 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 6.0 listening on the remote host is prior to 6.0.37. It is, therefore, affected by multiple vulnerabilities : - An error exists related to chunked transfer encoding and extensions that allows limited denial of service...

Apache Tomcat 7.0.0 < 7.0.33

The version of Tomcat installed on the remote host is prior to 7.0.33. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.33security-7 advisory. - java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomc...

CVE-2013-0937

Session fixation vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to hijack web sessions via unspecified vectors...

Session fixation

Session fixation vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-0937

Session fixation vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-0937

CVE-2013-0937 is a session-fixation vulnerability affecting EMC Documentum Webtop, WDK, Taskspace, and Records Manager up to version 6.7 SP2. The entry describes that remote attackers could hijack an authenticated session via unspecified vectors. Affected components include Webtop, WDK, Taskspace...

CVE-2013-2067

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

ESA-2013-021: EMC Documentum Multiple Vulnerabilities

ESA-2013-021.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-021: EMC Documentum Multiple Vulnerabilities EMC Identifier: ESA-2013-021 CVE Identifier: CVE-2013-0937, CVE-2013-0938, CVE-2013-0939 Severity Rating: See below for individual scores Affected products: • EMC Documentum Webtop...

[SECURITY] CVE-2013-2067 Session fixation with FORM authenticator

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-2067 Session fixation with FORM authenticator Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.32 - - Tomcat 6.0.21 to 6.0.36 Description: FORM authentication associates the most recent...

Apache Tomcat security vulnerabilities

DoS, session fixation, information leakage...

EMC Documentum multiple security vulnerabilities

Session fixation, crossite scripting...

UBUNTU-CVE-2013-2067

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

Fixed in Apache Tomcat 6.0.37

Important: Session fixation CVE-2013-2067 FORM authentication associates the most recent request requiring authentication with the current session. By repeatedly sending a request for an authenticated resource while the victim is completing the login form, an attacker could inject a request that...

Oracle WebCenter Sites Satellite Server - HTTP Header Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: HTTP header injection/Cache poisoning in Oracle WebCenter Sites Satellite Server product: Oracle WebCenter Sites Satellite Server former FatWire Satellite Server vulnerab...

Oracle WebCenter Sites Satellite Server - HTTP Header Injection

Exploit for windows platform in category web applications Vendor description: ------------------- FatWire Satellite Server is a predecessor product of Oracle WebCenter Sites Satellite Server. "Oracle WebCenter Sites Satellite Server enables organizations to deliver segmented, targeted, and...

Oracle WebCenter Sites Satellite Server - HTTP Header Injection

Oracle WebCenter Sites Satellite Server - HTTP Header Injection SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: HTTP header injection/Cache poisoning in Oracle WebCenter Sites Satellite Server product: Oracle WebCenter...

MediaWiki 会话固定漏洞(CVE-2012-5391)

BUGTRAQ ID: 58019 CVECAN ID: CVE-2012-5391 MediaWiki是著名的wiki程序，运行于PHP+MySQL环境。 MediaWiki 1.20及其他版本在实现上存在会话固定漏洞，攻击者可利用此漏洞劫持任意会话，获取未授权访问权限等。 0 MediaWiki 1.20 厂商补丁： MediaWiki --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://wikipedia.sourceforge.net/...

[PT-2012-53] Privilege Gaining in DataLife Engine

----------------------------------------------------------- PT-2012-53 Positive Technologies Security Advisory Privilege Gaining in DataLife Engine ----------------------------------------------------------- --- Vulnerable software DataLife Engine Version: 9.7 and earlier Application link:...

DataLife Engine 9.7 Session Fixation

----------------------------------------------------------- PT-2012-53 Positive Technologies Security Advisory Privilege Gaining in DataLife Engine ----------------------------------------------------------- --- Vulnerable software DataLife Engine Version: 9.7 and earlier Application link:...

Session fixation

The Session Manager in IBM Sterling Connect:Direct through 4.1.0.3 on UNIX allows remote attackers to cause a denial of service daemon crash and disk consumption via crafted data...