Telekom Magenta CMS - Multiple Cross Site Vulnerabilities

Document Title: =============== Telekom Magenta CMS - Multiple Cross Site Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2052 Telekom Security ID: 20161216SSc01 Release Date: ============= 2017-09-17 Vulnerability Laboratory ID VL-ID:...

EulerOS 2.0 SP2 : libXpm, libXdmcp, libICE (EulerOS-SA-2017-1212)

According to the versions of the libXpm, libXdmcp, libICE packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow flaw leading to a heap-based buffer overflow was found in libXpm. An attacker could use this flaw to crash...

EulerOS 2.0 SP1 : libXpm, libXdmcp, libICE (EulerOS-SA-2017-1211)

According to the versions of the libXpm, libXdmcp, libICE packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow flaw leading to a heap-based buffer overflow was found in libXpm. An attacker could use this flaw to crash...

Session fixation

A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...

CVE-2016-10405

Session fixation vulnerability in D-Link DIR-600L routers rev. Ax with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors...

MGASA-2017-0330 Updated libxdmcp packages fix security vulnerability

XDM uses weak entropy to generate the session keys on non BSD systems. On multi user systems it might possible to check the PID of the process and how long it is running to get an estimate of these values, which could allow an attacker to attach to the session of a different user CVE-2017-2625...

Updated rt/perl-Encode packages fix security vulnerability

RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket CVE-2012-4733. RT 3.8.0 and above include a version of bin/rt th...

Digium Asterisk Open Source and Certified Asterisk Session Hijacking Vulnerability

Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. A security vulnerability exists in Asterisk...

Session Hijacking Bug Exposed GitLab Users Private Tokens

GitLab, the popular web-based Git repository manager, fixed a vulnerability recently that could have exposed its users to session hijacking attacks. Daniel Svartman, a security researcher with Imperva, discovered the issue in May but couldn’t disclose it until Wednesday, after GitLab was able to...

Siemens Fixes Session Hijacking Bug in LOGO!, Warns of Man-in-the-Middle Attacks

Administrators who have Siemens’ LOGO! logic module deployed in automation setups are being urged to update its firmware. The German industrial manufacturing giant pushed out an update for its LOGO! 8 BM devices Wednesday morning to fix a vulnerability CVE-2017-12734 that could let an attacker...

Siemens LOGO! (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! Vulnerabilities: Insufficiently Protected Credentials, Man-in-the-Middle 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

rest-client session fixation vulnerability

The rest-client aka REST Client is one of those simple HTTP and REST clients. A session fixation vulnerability exists in rest-client. An attacker can exploit this vulnerability to hijack a session or gain access to sensitive information...

Cisco Integrated Management Controller User Session Hijacking Vulnerability

According to its self-reported version, the Cisco Unified Computing System Management Software is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

Synology Photo Station Unauthenticated Remote Code Execution

Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo...

Unikrn: ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com)

Summary: Vulnerabilities in OpenSSH Session Hijacking Vulnerability is a Medium risk vulnerability that is one of the most frequently found on networks around the world. This issue has been around since at least 1990 but has proven either difficult to detect, difficult to resolve or prone to bein...

Unit4 Polska TETA Web Session Fixation Vulnerability

Unit4 Polska TETA Web formerly known as TETA Galactica is a package of solutions including personnel, financial and logistics management systems from Unit4 Poland. A session fixation vulnerability exists in Unit4 Polska TETA Web 22.62.3.4 and earlier versions. A remote attacker can exploit the...

RedHat Update for X.org X11 libraries RHSA-2017:1865-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco Adaptive Security Appliance Cross-Site Scripting Vulnerability (CNVD-2017-20380)

The Cisco Adaptive Security Appliance is a set of firewall appliances from the American company Cisco. A cross-site scripting vulnerability exists in the Cisco Adaptive Security Appliance WEB management script, which allows remote attackers to exploit the vulnerability to inject malicious script ...

CVE-2016-9981

IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257...

libICE: weak entropy usage in session keys

It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list...