Updated novnc packages fix CVE-2013-7436

Updated novnc package fixes security vulnerability: noVNC before 0.5.1 allows an attacker to steal insecurely set session token cookies, hijacking active or inactive VNC sessions CVE-2013-7436...

MGASA-2015-0133 Updated novnc packages fix CVE-2013-7436

Updated novnc package fixes security vulnerability: noVNC before 0.5.1 allows an attacker to steal insecurely set session token cookies, hijacking active or inactive VNC sessions CVE-2013-7436...

Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting

------------------------------------------------------------------------ Citrix NITRO SDK xenhotfix page is vulnerable to Cross-Site Scripting ------------------------------------------------------------------------ Han Sahin, August 2014...

Cross-Site Scripting vulnerability in Websense Data Security block page

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Websense Data Security block page ------------------------------------------------------------------------ Han Sahin, September 2014...

EMC M&R (Watch4net) Alerting Frontend XSS Vulnerability

A cross site scripting vulnerability was found in EMC M&R Watch4net Alerting Frontend. This issue allows attackers to perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, logging their keystrokes, or exploi...

EMC M&R (Watch4net) Centralized Management Console XSS Vulnerability

A cross site scripting vulnerability was found in EMC M&R Watch4net Centralized Management Console. This issue allows attackers to perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, logging their...

Vimeo: Vimeo.com - reflected xss vulnerability

Hi. I want to report a Reflected xss vulnerability that I found in www.vimeo.com website and which can affect the safety of your users. This vulnerability allows an attacker to inject in web pages javascript content for sending malicious scripts to an unsuspecting user. This flaw can access any...

WePay: Broken Authentication – Session Token bug

Hi I found a broken authentitication vuln POC: 1- Create a Wepay account 2- Confirm your email 3- Now request a password reset for your account. 4- Don’t use the password reset link that was sent to your email. 5- Login to your account, remember don’t use first the reset password link you request...

X (Formerly Twitter): Abuse of "Remember Me" functionality.

Steps to Reproduce:- 1. Navigate to https://twitter.com/login, Fill up the required details and click on the "Log in" button. Make sure you have checked "Remember Me" check-box. 2. Login Successfully, Analyze the cookie using FireBug, specially "authtoken" and "remembercheckedon". These cookies...

flash-plugin: information disclosure leading to session token leak (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow remote attackers to discover session tokens via...

Encore Discovery Solution Multiple Vulnerability Disclosure

Product: Encore Discovery Solution Vendor: Innovative Interfaces Inc Vulnerable Version: 4.3 Tested Version: 4.3 Vendor Notification: June 19, 2014 Public Disclosure: August 26, 2014 Vulnerability Type: Open Redirect CWE-601 CVE Reference: CVE-2014-5127 Risk Level: Medium CVSSv2 Base Score: 4.3...

CVE-2014-5128

The vulnerability CVE-2014-5128 affects Encore Discovery Solution 4.3 from Innovative Interfaces Inc. The advisory details that the product “places a session token in the URI,” exposing the session token via GET parameters and creating potential information leakage through unspecified vectors. Th...

CVE-2014-5128

Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-5128

Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors...

Information disclosure

Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors...

Conceptronic Grab’n’Go and Sitecom Storage Center Password Disclosure

No description provided by source. Updated to include Sitecom MD-253 and MD254 Minor textual changes == Conceptronic Grab’n’Go and Sitecom Storage Center - Password disclosure Vulnerability - Security Advisory AA-002 Severity Rating: High Discovery Date: May 5, 2012 Vendor Notification: May 31,...

Novell GroupWise <= 8.0 WebAccess Multiple Security Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/35066/info Novell GroupWise WebAccess is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions or conduct cross-site scripting attacks. Note that some of...

Simple Machines forum (SMF) 2.0 session hijacking

No description provided by source. Simple Machines forum SMF 2.0 session hijacking Found by The X-C3LL and seth http://0verl0ad.blogspot.com/ || http://xd-blog.com.ar/ 2011-08-06 Website: http://www.simplemachines.org/ Greets: yoyahack, eddyw, www.portalhacker.net SMF stops csrf attacks sending a...

CA 2E Web Option 8.1.2 - Authentication Bypass

No description provided by source. Vulnerability title: Unauthenticated Privilege Escalation in CA 2E Web Option CVE: CVE-2014-1219 Vendor: CA Product: 2E Web Option Affected version: 8.1.2 Fixed version: N/A Reported by: Mike Emery Details: CA 2E Web Option r8.1.2 and potentially others, is...

ZeroShell 'cgi-bin/kerbynet' - Local File Disclosure Vulnerability

No description provided by source. Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named kerbynet interpreted in cgi-bin directory here : /cdrom/usr/local/apache2/cgi-bin/kerbynet So all...