CVE-2016-2076

Client Integration Plugin CIP in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site...

Code injection

Client Integration Plugin CIP in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site...

CVE-2016-2076

CVE-2016-2076 affects VMware products including vCenter Server (5.5 U3a/U3b/U3c and 6.0 before U2), vCloud Director 5.5.5, and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1. The issue is improper handling of session content by the VMware Client Integration Plugin (CIP), enabling rem...

VMware Security Updates for vCenter Server (VMSA-2016-0004)

VMware vCenter Server updates address a critical security issue. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM Financial Transaction Manager for Corporate Payment Services Cross-Site Scripting Vulnerability

IBM Financial Transaction Managerfor Corporate Payment Services is a financial transaction manager product that focuses on monitoring, tracking, and reporting financial payments and transactions. A cross-site scripting vulnerability in IBM FTM for Corporate Payment Services on multiple platforms...

C & C++ for OS - Filter Bypass & Persistent Vulnerability

Document Title: =============== C & C++ for OS - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1825 Release Date: ============= 2016-04-13 Vulnerability Laboratory ID VL-ID: ====================================...

Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1821 Release Date: ============= 2016-04-13 Vulnerability Laboratory ID VL-ID: ==================================...

WPN-XM 0.8.6 Cross Site Scripting

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WPNXM-XSS.txt Vendor: =========== wpn-xm.org Product: ======== WPN-XM Serverstack for Windows - Version 0.8.6 WPN-XM is a free and open-source web server solution stack for professional PHP...

Amazon Linux AMI : tomcat8 (ALAS-2016-679)

ResourceLinkFactory.setGlobalContext is a public method and was discovered to be accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web...

Cross-site request forgery (CSRF) vulnerability in administrate gem

"Administrate::ApplicationController actions didn't have CSRF protection. Remote attackers can hijack user's sessions and use any functionality that administrate exposes on their behalf."...

Amazon Linux: Security Advisory (ALAS-2016-679)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DirectAdmin CP v1.50.0 - CS CSRF Web Vulnerability

Document Title: =============== DirectAdmin CP v1.50.0 - CS CSRF Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1783 Release Date: ============= 2016-03-20 Vulnerability Laboratory ID VL-ID: ==================================== 1783...

Gratipay: auto-logout after 20 minutes

Hi, Session is not getting expired even after keeping the application idle for 20 min and after browser closure. Information: JavaScript code can be used by the web application in all or critical pages to automatically logout client sessions after the idle timeout expires, for example, by...

Medium: tomcat7

Issue Overview: A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application in a getResource,...

Updated tomcat packages fix security vulnerabilities

Updated tomcat packages fix security vulnerabilities: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 7.x before 7.0.65 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used b...

The vulnerability of Adobe Connect’s instant messaging program allows a hacker to replace a user during the session.

The vulnerability of the Adobe Connect instant messaging program is related to the of cross-site requests. Exploiting this vulnerability allows a malicious actor to replace the user during the session...

Fing 3.3.0 Persistent Mail Encoding

Document Title: =============== Fing v3.3.0 iOS - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1772 Release Date: ============= 2016-02-29 Vulnerability Laboratory ID VL-ID: ====================================...

Node.js HTTP Request Smuggling Vulnerability

Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...

eFront Learning CMS 3.6.15.6 Cross Site Scripting

Document Title: =============== eFront Learning 3.6.15.6 CMS - Forum Persistent Title Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1761 Release Date: ============= 2016-02-23 Vulnerability Laboratory ID VL-ID:...

WordPress Calculated Fields Form 1.0.x Session Hijacking

Exploit Title: WordPress Calculated Fields Form =1.0.x - Httponly bypass & admin session hijackig. Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/calculated-fields-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI:...