Design/Logic Flaw

IBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout action, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

CVE-2013-2997

IBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout action, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability

Document Title: =============== eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1064 Release Date: ============= 2013-08-30 Vulnerability Laboratory ID VL-ID: ===================================...

[CookieCatcher] Session Hijacking Tool

CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used without proper...

PHP 5.5.x < 5.5.3 Multiple Vulnerabilities

According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.3. It is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the 'Sessions' subsystem that can allow an attacker to hijack the session of another...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4762

Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID...

Default credentials

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4962

The CVE-2013-4962 entry concerns Puppet Enterprise prior to 3.0.1 where the reset password page does not require the current password. This can let an attacker modify user passwords by exploiting session hijacking, an unattended workstation, or other vectors. The description consistently states t...

CVE-2013-4762

CVE-2013-4762 affects Puppet Enterprise before 3.0.1: the logout flow does not sufficiently invalidate the user session, which could allow remote attackers to hijack a session by obtaining an old session ID. This root cause is consistently described across multiple sources (NVD, Red Hat, Ubuntu, ...

CVE-2013-4962

Removed by vendor...

CVE-2013-4128

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4213

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

Design/Logic Flaw

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4213

Red Hat JBoss EAP 6.1.0 is affected by CVE-2013-4213. The issue is a caching flaw in the EJB client API that prevents proper caching of EJB invocations on the server, allowing remote attackers to hijack user sessions by leveraging an EJB client. This is tied to the Red Hat advisory RHSA-2013:1152...

CVE-2013-4128

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

ejb-client: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

remote-naming: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

remote-naming: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...