IBM SPSS Data Collection CVE-2013-0464跨站脚本漏洞

Bugtraq ID:60246 CVE ID:CVE-2013-0464 IBM SPSS Data Collection是全球业界领先的问卷调查、市场研究以及客户行为分析的专业解决方案。 IBM SPSS Data Collection存在一个输入验证漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被用户查看时可获取敏感信息或劫持用户会话。 0 IBM SPSS Data Collection 6.0.1 IBM SPSS Data Collection 6.0 IBM SPSS Data Collection 7.0 用户可参考如下厂商提供的安全公告获得补丁程序：...

Bluetooth Chat Connect v1.0 iOS - Multiple Vulnerabilities

Document Title: =============== Bluetooth Chat Connect v1.0 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=960 Release Date: ============= 2013-05-31 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2013-2313: Improper Authentication

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

Alt-N MDaemon < 13.0.4 Multiple Vulnerabilities

The remote Windows host is running a version of Alt-N MDaemon that is earlier than 13.0.4. It is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the 'Strip X-Headers' setting that could allow the application to crash. Issue 10358 - An input...

PT-2013-2967

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description A session fixation issue allows remote attackers to hijack web sessions. The exact vectors used for the attack are not specified. Recommendations At the moment,...

Sony PSN Community Lithium Forums 2012 Q4 XSS

Title: ====== Sony PSN Community - Persistent Web Vulnerability Date: ===== 2013-05-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=746 VL-ID: ===== 746 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

CVE-2013-0937

Session fixation vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to hijack web sessions via unspecified vectors...

[Fern Wifi Cracker] Wireless security auditing and attack software to crack and recover WEP/WPA/WPS keys

Fern Wifi Cracker is a Wireless security auditing and attack software program written using the Python Programming Language and the Python Qt GUI library, the program is able to crack and recover WEP/WPA/WPS keys and also run other network based attacks on wireless or ethernet based networks...

Matrix42 Service Store 5.3 SP3 Cross Site Scripting

43zsec SECURITY ADVISORY CVE ID : CVE-2013-2504 Product: Service Store 5.3 SP3 5.33.946.0 Vendor: matrix42 - member of asseco group Subject: Cross-site Scripting - XSS Classification: PCI 2.0: 6.5.7 PCI 1.2: 6.5.1 OWASP: A2 CWE: 79 CAPEC: 19 WASC: 08 Risk: High Effect: Remotely exploitable Author...

cookie domain tailmatch

libcurl is vulnerable to a cookie leak vulnerability when doing requests across domains with matching tails. When communicating over HTTPS and having libcurl's cookie engine enabled, libcurl stores and holds cookies for use when subsequent requests are done to hosts and paths that match those kep...

CURL-CVE-2013-1944 cookie domain tailmatch

libcurl is vulnerable to a cookie leak vulnerability when doing requests across domains with matching tails. When communicating over HTTPS and having libcurl's cookie engine enabled, libcurl stores and holds cookies for use when subsequent requests are done to hosts and paths that match those kep...

Avira License - Cross Site Scripting Web Vulnerability

Document Title: =============== Avira License - Cross Site Scripting Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=916 Avira Case-ID 99287655 Release Date: ============= 2013-04-12 Vulnerability Laboratory ID VL-ID:...

PT-2013-1237

Name of the Vulnerable Software and Affected Versions cURL versions prior to 7.30.0 cURL versions prior to 7.34.0-r1 libcurl versions prior to 7.30.0 Description The issue concerns a cookie leak vulnerability in cURL and libcurl, allowing remote attackers to steal cookies via a matching suffix in...

CVE-2013-1168

The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a sessio...

CVE-2013-1168

The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a sessio...

CVE-2013-1168: Undefined Security Weakness

The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a sessio...

PT-2013-2936

Name of the Vulnerable Software and Affected Versions Cisco Unified MeetingPlace Application Server versions 7.0 through 7.1MR1 Patch 1 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.0MR1 Patch 0 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.5MR2 Patch...

[Ghost Phisher] GUI suite for phishing and penetration attacks

Ghost Phisher is a Wireless and Ethernet security auditing and attack software program written using the Python Programming Language and the Python Qt GUI library, the program is able to emulate access points and deploy various internal networking servers for networking, penetration testing and...

Cookies can be set for a top-level domain – Opera Security Advisories

Browsers should only allow cookies to be set for the website that created them. In some specific cases, Opera does not apply this restriction correctly, and allows a website to set a cookie for its entire top-level domain such as .com or .co.uk. A malicious site could then redirect the user to...

PayPal GP+ Cross Site Scripting

Title: ====== Paypal Bug Bounty 46 - Persistent Web Vulnerability Date: ===== 2013-03-28 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=805 PayPal Security UID: esj1f86plc VL-ID: ===== 805 Common Vulnerability Scoring System: ==================================== 4.3...