Server: ACLs not properly enforced in "documents" application

The "documents" application is a collaborative web-based online editor for ODT files. Using this application you can easily share and collaborate on office documents. This application uses strong and very long random "Session IDs" to limit access to specific resources. Knowledge of this ID allows...

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

Design/Logic Flaw

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

Cross site request forgery (csrf)

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page...

CVE-2014-0153

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page...

CVE-2014-0153

CVE-2014-0153 affects oVirt REST API prior to the 3.4.1/3.4.x updates, where session IDs are stored in HTML5 local storage. The underlying risk is that an attacker could read a user’s session ID from local storage via a crafted web page, leading to potential confidentiality impact. Affected softw...

Tridium Niagara AX Web Server < 3.5.40.3 / 3.6 < 3.6.47.3 Multiple Vulnerabilities

Binary data 8348.prm...

Debian DSA-2944-1 : gnutls26 - security update

Joonas Kuorilehto discovered that GNU TLS performed insufficient validation of session IDs during TLS/SSL handshakes. A malicious server could use this to execute arbitrary code or perform denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

gnutls26 security update

Package : gnutls26 Version : 2.8.6-1+squeeze4 CVE ID : CVE-2014-3466 Joonas Kuorilehto discovered that GNU TLS performed insufficient validation of session IDs during TLS/SSL handshakes. A malicious server could use this to execute arbitrary code or perform denial or service...

DLA-0001-1 gnutls26 - security update

Bulletin has no description...

DSA-2944-1 gnutls26 - security update

Bulletin has no description...

Debian: Security Advisory (DSA-2944-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM Patches Predictable Output Problem in SecureRandom PRNG

Details have surfaced on a recently patched vulnerability in IBM’s SecureRandom pseudo-random number generator that could allow an attacker to predict its output. Only the default SecureRandom implementation in the IBM Java Cryptography Extension JCE framework is vulnerable; IBM recommends that...

MediaWiki < 1.19.9 / 1.20.8 / 1.21.3 Multiple Vulnerabilities

According to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities : - Input validation errors exist that allow cross-site scripting attacks. CVE-2013-4567, CVE-2013-4568 - An error exists related to session IDs and HTTP headers that...

CVE-2013-0539

An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for remote attackers to hijack sessions, and consequently obtain sensitive information, via a brute-force attack...

Tridium Niagara AX Web Server Multiple Vulnerabilities

Binary data scadatridiumniagarapatch18dec2012.nbin...

CVE-2013-4732: Undefined Security Weakness

The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU662676...

Digital Alert Systems DASDEC and Monroe Electronics R189 One-Net firmware exposes private root SSH key

Overview Digital Alert Systems DASDEC and Monroe Electronics One-Net E189 Emergency Alert System EAS devices exposed a shared private root SSH key in publicly available firmware images. An attacker with SSH access to a device could use the key to log in with root privileges. Description The Digit...

Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language EL, evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a 1 name attribute in a a spring:hasBindErrors ta...