dnaLIMS Code Execution / XSS / Traversal / Session Hijacking

Title: Multiple vulnerabilities discovered in dnaLIMS DNA sequencing web-application Advisory URL: https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/ Date published: Mar 08, 2017 Vendor: dnaTools, Inc. CVE IDs: 2017-6526, 2017-6527, 2017-6528, 2017-6529 USCERT VU:...

dnaLIMS DNA Sequencing - Directory Traversal / Session Hijacking / Cross-Site Scripting

Title: Multiple vulnerabilities discovered in dnaLIMS DNA sequencing web-application Advisory URL: https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/ Date published: Mar 08, 2017 Vendor: dnaTools, Inc. CVE IDs: 2017-6526, 2017-6527, 2017-6528, 2017-6529 USCERT VU:...

Session fixation

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter...

CVE-2017-6529

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter...

CVE-2017-6529

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter...

CVE-2017-6529

CVE-2017-6529 affects dnaTools dnaLIMS 4-2015s13. The vulnerability allows session hijacking by guessing and supplying the UID parameter in URLs that require authentication, where the UID appears to serve as a session identifier. Public descriptions demonstrate that multiple pages rely on a UID p...

CVE-2017-6529

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter...

CVE-2017-6529

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter. Recent assessments: h00die at March 27, 2020 4:08pm UTC reported: The uid field is passed within a GET parameter. These are sequential integers, so it is trivial to...

CVE-2016-10205

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie...

CVE-2017-2626

It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list...

Honeywell XL Web Multiple Vulnerabilities

Honeywell XL Web is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

How A Bug Hunter Forced Apple to Completely Remove A Newly Launched Feature

Recently Apple released a new Feature for iPhone and iPad users, but it was so buggy that the company had no option other than rolling back the feature completely. In November, Apple introduced a new App Store feature, dubbed "Notify" button — a bright orange button that users can click if they...

USN-3024-1: tomcat6, tomcat7 vulnerabilities | Cloud Foundry

USN-3024-1: tomcat6, tomcat7 vulnerabilities Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote...

Salesforce (Event Registration) - Persistent Vulnerability

Document Title: =============== Salesforce Event Registration - Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1991 Release Date: ============= 2017-01-11 Vulnerability Laboratory ID VL-ID: ====================================...

Salesforce (Event Registration) - Persistent Vulnerability

Document Title: =============== Salesforce Event Registration - Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1991 Release Date: ============= 2017-01-11 Vulnerability Laboratory ID VL-ID: ====================================...

Rockstar Games: [IMP] - Blind XSS in the admin panel for reviewing comments

@anshumanbh discovered that it is possible to exploit a Blind XSS vulnerability under the "MOUTHOFF TO ROCKSTAR" section while providing feedback. The result is a XSS vulnerability being exploited on an internal Rockstar Games domain. The way this worked was that an attacker would submit a...

Blackboard LMS 9.1 SP14 - Cross-Site Scripting

Blackboard LMS 9.1 SP14 - Cross-Site Scripting Document Title: =============== Blackboard LMS 9.1 SP14 - Profile Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1900 Release Date: ============= 2017-01-09 Vulnerability Laboratory...

Oracle Opera Session Hijacking Vulnerability

Oracle Opera is the United States Oracle Oracle company's set of hotel reservation and management system. A security vulnerability exists in Oracle Opera. An attacker could exploit this vulnerability to hijack a session...

Plone - 'in_portal.py' <= 4.1.3 Session Hijacking

source: http://www.securityfocus.com/bid/61964/info Plone is prone to a session-hijacking vulnerability. An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application. Note: This issue was previously discussed in the BID 61544 Plone Multiple...

Red Hat keycloak session hijacking vulnerability

Red Hat keycloak is a suite of open source identity and access management software for modern applications and services from Red Hat. A session hijacking vulnerability exists in Red Hat keycloak. An attacker could exploit this vulnerability to gain unauthorized access to affected applications...