CVE-2019-8345

The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used, and an attacker's web site is displayed in a WebView with no information about the URL...

CVE-2019-8345

CVE-2019-8345 affects ES File Explorer File Manager for Android (version 4.1.9.7.4). The Help feature loads content over HTTP, enabling session hijacking by a local-network MITM attacker, who could display an attacker-controlled site in a WebView without URL information. No exploit details or pat...

CVE-2019-8345

The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used, and an attacker's web site is displayed in a WebView with no information about the URL...

GHSA-5Q75-CXCQ-WR26 Cross-site Scripting in jspwiki-war

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

Cross-site Scripting in jspwiki-war

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

Cross site scripting

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

CVE-2018-20242

This CVE affects Apache JSPWiki up to version 2.10.5, where a crafted URL could trigger a cross-site scripting (XSS) vulnerability. The described impact is potential session hijacking. The connected documents consistently identify JSPWiki as the affected product and the vulnerability type as XSS,...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

GitLab: Privilege escalation from any user (including external) to gitlab admin when admin impersonates you

Summary: Hey team, I have discovered a way for any logged in user attacker to escalate his privileges to gitlab administrator if the real gitlab administrator impersonates attacker's account. Description: When the gitlab admin impersonates some user, he gets new gitlabsession cookie and then...

Security Bulletin: Vulnerabilities in curl affect IBM Chassis Management Module (CMM) (CVE-2013-4545, CVE-2014-0015, CVE-2014-0138, CVE-2014-0139, CVE-2013-2174)

Summary Multiple vulnerabilities in curl affect IBM Chassis Management Module CMM. Vulnerability Details Summary Multiple vulnerabilities in curl affect IBM Chassis Management Module CMM. Vulnerability Details CVE-ID: CVE-2013-4545 Description: cURL/libcURL could allow a remote attacker to conduc...

Open-Xchange OX App Suite Cross Site Scripting / SSRF

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 59653 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.0 Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.0-rev13 Vendor notification:...

Session Hijacking

openstack-nova is vulnerable to session hijacking attacks. The vulnerability exists as OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users f...

Session Hijacking

jboss-remote-naming is vulnerable to session hijacking attacks. The vulnerability exists as Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

Apache Tomcat < 6.0.14 Multiple Vulnerabilities

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.14. It is, therefore, affected by the following vulnerabilities : - Cross-site scripting XSS vulnerabilities exists due to improper validation of user-supplied input before...

Detecting Insecure Cookies with Qualys Web Application Scanning

Cookies are ubiquitous in today's modern web applications. If an attacker can acquire a user's session cookie by exploiting a cross-site scripting XSS vulnerability, by sniffing an unencrypted HTTP connection, or by some other means, then they can potentially hijack a user's valid session...

CVE-2018-1000409

A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a user signed up for a new user account...

BMC Network Automation 8.7.00.000 Session Hijacking

Intro: The BMC Network Automation allows authenticated users to hijack established remote sessions of other users, version v8.7.00.000 b383 u038 was confirmed to be vulnerable. Details: Authenticated users of the BMC Network Automation web application with assigned aviewera role are able to hijac...