AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "AlienVault OSSIM/USM Remote Code Execution", 'Description' = %q This module exploits object injection, authentication bypass an...

WordPress Plugin WP Live Chat Support Stored Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Software Foundation.Live Chat Support is one of the chat plugins. WordPress plugin WP Live Chat Support has a stored cross-site scripting vulnerability that can be exploited by an attacker to log in as a WordPress user and perform...

WordPress All in One SEO Pack Plugin 2.3.6.1 - Persistent XSS

Because of this vulnerability, an attacker can steal administrators session token or perform other arbitrary actions. Solution Update the WordPress plugin to the newer stable and safe version...

CVE-2016-5722

Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and obtain sensitive information by sniffing the network...

Design/Logic Flaw

Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and obtain sensitive information by sniffing the network...

CVE-2016-5722

CVE-2016-5722 affects Huawei OceanStor storage series (5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, 18500 V3) prior to version V300R003C10 . Root cause: the session token is transmitted in plaintext within the HTTP header, enabling remote attackers to sniff traffic and perform replay at...

CVE-2016-5722

Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and obtain sensitive information by sniffing the network...

AirDroid Patches Vulnerability Exposing Android Data

A critical vulnerability impacting 50 million Android users running the popular AirDroid application has been patched. AirDroid, an app that allows you link an Android device to a computer and send SMS messages, run apps and add contacts via a Wi-Fi connected web browser, released the patch Jan...

Cisco Unified Communications Manager Denial of Service Vulnerability (CNVD-2015-08374)

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A security vulnerability exists in the Identi...

Janitza UMG Session Token Flaw Vulnerability

The Janitza UMG is an online power quality monitor for the energy industry from Janitza Germany. Janitza UMG 508, 509, 511, 604,605 has a session-token flaw. Allows a remote attacker to perform calculations on the session-token value and determine the PIN value...

CVE-2015-3973

Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine a PIN value via unspecified computations on session-token values...

Symantec Endpoint Protection ConsoleServlet ResetPassword Policy Bypass (CVE-2015-1486)

An authentication bypass vulnerability exists in Symantec Endpoint Protection. This vulnerability is due to a design flaw that lets unauthenticated users to retrieve a valid session token. A remote, unauthenticated attacker may exploit this vulnerability to create an admin account and access the...

ownCloud: s2.owncloud.com: SSL Session cookie without secure flag set

URL: https://s2.owncloud.com/ Issue detail The following cookie was issued by the application and does not have the secure flag set: sessionid=0fdc40cc016d1e70b1567b0071e5dcd2; expires=Sat Aug 22 03:45:12 2015; path=/; domain=s2.owncloud.com; max-age=86387; httponly The cookie appears to contain ...

Janitza UMG Power Quality Measuring Products Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on September 22, 2015, and is being released to the NCCIC/ICS-CERT web site. Mattijs van Ommeren of Applied Risk has identified several vulnerabilities in the Janitza UMG power quality measuring products. Janitza ha...

SUSE-SU-2015:1300-1 Security update for novnc

novnc was updated to fix a session hijacking problem through insecurely set session token cookies bnc922233, CVE-2013-7436. Security Issues: CVE-2013-7436...

Heroku API - Re Auth Session Token Bypass Vulnerability

Document Title: =============== Heroku API - Re Auth Session Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1336 View: https://www.youtube.com/watch?v=1WpWVVXVUSs Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1323 Release Date:...

ESC 8832 Data Controller - Multiple Vulnerabilities

ESC 8832 Data Controller - Multiple Vulnerabilities =begin Exploit Title: ESC 8832 Data Controller multiple vulnerabilities Date: 2014-05-29 Platform: SCADA / Web Application Exploit Author: Balazs Makany Vendor Homepage: www.envirosys.com Version: ESC 8832 Data Controller Hardware Tested on: ESC...

Vesta Control Panel 0.9.8 Cross Site Request Forgery

Exploit Title: Vesta Control Panel CSRFchange admin password Date: 24-05-2015 Exploit Author: Ben Khlifa Fahmi Vendor Homepage: https://vestacp.com/ Software Link: http://vestacp.com/pub/vst-install.sh Version: 0.9.8amd64 Tested on: ubuntu trusty 14.04 Description:...

Grindr for iOS Session Token Remote Password Manipulation Vulnerability

Grindr for iOS is GPS based mobile app. A security vulnerability in the Grindr for iOS reset password feature allows attackers to exploit the vulnerability to intercept session tokens, change email values, and reset passwords...

Shopify: SSL cookie without secure flag set

hello shopify security team, I have found security vulnerability. Vulnerable URL :- https://app.shopify.com/services/signup/track/ The following cookie was issued by the application and does not have the secure flag set: signupsessionid=0875b12b680173807271e6c444a964e8; path=/; expires=Mon, 04 Ma...