CVE-2016-8924

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...

Code injection

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230...

CVE-2016-8924

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...

CVE-2016-8924

CVE-2016-8924 affects IBM Maximo Asset Management core versions 7.1, 7.5 and 7.6 (and related Industry Solutions/Control Desk products). The vulnerability stems from failing to invalidate an existing session identifier, enabling remote session hijacking to access another user’s session. IBM’s Sec...

Cisco Integrated Management Controller Hijacked Session Vulnerability

Cisco Integrated Management Controller IMC is the U.S. Cisco Cisco company a set of tools for the management of the UCS Unified Computing System, which supports HTTP, SSH access, etc., and can be on the server, shutdown and reboot operations. A security vulnerability exists in the session...

CVE-2017-6617

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

CVE-2017-6617

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

CVE-2017-6617

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...

Cisco Integrated Management Controller User Session Hijacking Vulnerability (cisco-sa-20170419-cimc2)

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. SPDX-FileCopyrightText: 2017 Greenbone AG Some text...

Cisco Integrated Management Controller User Session Hijacking Vulnerability

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software do...

Default credentials

An attacker that has hijacked a Unitrends Enterprise Backup before 9.1.2 web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover...

CVE-2017-7284

The CVE-2017-7284 entry describes a vulnerability in Unitrends Enterprise Backup (pre-9.1.2) where an attacker who has hijacked a web session can use api/includes/users.php to change the password of the currently logged-in account without knowing the existing password, enabling account takeover. ...

Trend Micro InterScan Web Security Virtual Appliance HTML Injection Vulnerability

The Trend Micro InterScan Web Security Virtual Appliance is a Web security gateway that provides dynamic, integrated security for enterprise networks against Web-based threats. The Trend Micro InterScan Web Security Virtual Appliance suffers from an HTML injection vulnerability. A remote attacker...

dnaLIMS Code Execution / XSS / Traversal / Session Hijacking （CVE-2017-6526）

dnaLIMS Code Execution / XSS / Traversal / Session Hijacking web-application Advisory URL: https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/ Date published: Mar 08, 2017 Vendor: dnaTools, Inc. CVE IDs: 2017-6526, 2017-6527, 2017-6528, 2017-6529 USCERT VU: 929263...

CVE-2016-8789

Huawei eSpace Integrated Access Device IAD with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS...

Sophos Web Appliance Session Fixation Vulnerability

Sophos Web Appliance SWA is a suite of Web security gateway products from Sophos UK. The product supports real-time web threat protection, customized web filtering and dynamic control of applications. A session fixation vulnerability exists in SWA versions prior to 4.3.1.2. An attacker can exploi...

Stored Cross-Site Scripting Vulnerability in Beijing Topsy's Government Affairs System

Beijing Topsy's government system is an intensive service platform based on cloud PAAS, with all kinds of portal government services, public services as the core, relying on mature big data, cloud computing, mobile Internet, content management, full-text search and other technologies, in accordan...

Stored Cross-Site Scripting Vulnerability in SuperCRM 'defaultpc.asp' Page

SuperCRM, produced by Walther Technology Limited, is the sales management component of Walther's CRM solution. A stored cross-site scripting vulnerability exists in the SuperCRM 'defaultpc.asp' page. It allows attackers to insert malicious js code into the page to obtain administrator cookies and...

Local Windows Admins Can Hijack Sessions Without Credentials

A researcher has exposed how attackers with local admin privileges could use native command-line Windows tools to hijack other users’ sessions without credentials. Researcher Alexander Korznikov on Friday published a report in which he describes how he could, locally and remotely via Remote Deskt...

SAP HANA Session Fixation Vulnerability

SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions, users can directly query and analyze a large amount of real-time business data. A session fixation vulnerability exists in SAP HANA. An attacker could exploit this vulnerability ...