Design/Logic Flaw

The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method...

CVE-2013-4629

CVE-2013-4629 concerns Huawei VP9610/VP9620 video-conference hardware where the login session ID is not updated after authentication, enabling session hijacking by a remote, authenticated attacker. Reported impacts align with CVSS metrics: high impact on confidentiality, integrity, and availabili...

CVE-2013-4629

The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method...

Barracuda Backup - Multiple Web Vulnerabilities

Document Title: =============== Barracuda Backup - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=783 BARRACUDA NETWORK SECURITY ID: BNSEC-881 Release Date: ============= 2013-06-14 Vulnerability Laboratory ID VL-ID:...

IBM SPSS Data Collection CVE-2013-0464跨站脚本漏洞

Bugtraq ID:60246 CVE ID:CVE-2013-0464 IBM SPSS Data Collection是全球业界领先的问卷调查、市场研究以及客户行为分析的专业解决方案。 IBM SPSS Data Collection存在一个输入验证漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被用户查看时可获取敏感信息或劫持用户会话。 0 IBM SPSS Data Collection 6.0.1 IBM SPSS Data Collection 6.0 IBM SPSS Data Collection 7.0 用户可参考如下厂商提供的安全公告获得补丁程序：...

Bluetooth Chat Connect v1.0 iOS - Multiple Vulnerabilities

Document Title: =============== Bluetooth Chat Connect v1.0 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=960 Release Date: ============= 2013-05-31 Vulnerability Laboratory ID VL-ID: ====================================...

Alt-N MDaemon < 13.0.4 Multiple Vulnerabilities

The remote Windows host is running a version of Alt-N MDaemon that is earlier than 13.0.4. It is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the 'Strip X-Headers' setting that could allow the application to crash. Issue 10358 - An input...

Sony PSN Community Lithium Forums 2012 Q4 XSS

Title: ====== Sony PSN Community - Persistent Web Vulnerability Date: ===== 2013-05-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=746 VL-ID: ===== 746 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

CVE-2013-0937

Session fixation vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to hijack web sessions via unspecified vectors...

[Fern Wifi Cracker] Wireless security auditing and attack software to crack and recover WEP/WPA/WPS keys

Fern Wifi Cracker is a Wireless security auditing and attack software program written using the Python Programming Language and the Python Qt GUI library, the program is able to crack and recover WEP/WPA/WPS keys and also run other network based attacks on wireless or ethernet based networks...

Matrix42 Service Store 5.3 SP3 Cross Site Scripting

43zsec SECURITY ADVISORY CVE ID : CVE-2013-2504 Product: Service Store 5.3 SP3 5.33.946.0 Vendor: matrix42 - member of asseco group Subject: Cross-site Scripting - XSS Classification: PCI 2.0: 6.5.7 PCI 1.2: 6.5.1 OWASP: A2 CWE: 79 CAPEC: 19 WASC: 08 Risk: High Effect: Remotely exploitable Author...

cookie domain tailmatch

libcurl is vulnerable to a cookie leak vulnerability when doing requests across domains with matching tails. When communicating over HTTPS and having libcurl's cookie engine enabled, libcurl stores and holds cookies for use when subsequent requests are done to hosts and paths that match those kep...

CURL-CVE-2013-1944 cookie domain tailmatch

libcurl is vulnerable to a cookie leak vulnerability when doing requests across domains with matching tails. When communicating over HTTPS and having libcurl's cookie engine enabled, libcurl stores and holds cookies for use when subsequent requests are done to hosts and paths that match those kep...

Avira License - Cross Site Scripting Web Vulnerability

Document Title: =============== Avira License - Cross Site Scripting Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=916 Avira Case-ID 99287655 Release Date: ============= 2013-04-12 Vulnerability Laboratory ID VL-ID:...

CVE-2013-1168

The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a sessio...

CVE-2013-1168

The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a sessio...

[Ghost Phisher] GUI suite for phishing and penetration attacks

Ghost Phisher is a Wireless and Ethernet security auditing and attack software program written using the Python Programming Language and the Python Qt GUI library, the program is able to emulate access points and deploy various internal networking servers for networking, penetration testing and...

Cookies can be set for a top-level domain – Opera Security Advisories

Browsers should only allow cookies to be set for the website that created them. In some specific cases, Opera does not apply this restriction correctly, and allows a website to set a cookie for its entire top-level domain such as .com or .co.uk. A malicious site could then redirect the user to...

PayPal GP+ Cross Site Scripting

Title: ====== Paypal Bug Bounty 46 - Persistent Web Vulnerability Date: ===== 2013-03-28 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=805 PayPal Security UID: esj1f86plc VL-ID: ===== 805 Common Vulnerability Scoring System: ==================================== 4.3...

Paypal Bug Bounty #46 - Persistent Web Vulnerability

Document Title: =============== Paypal Bug Bounty 46 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=805 PayPal Security UID: esj1f86plc Release Date: ============= 2013-03-28 Vulnerability Laboratory ID VL-ID:...