Karotz Smart Rabbit 12.07.19.00 Hijacking / Cleartext Token

Trustwave SpiderLabs Security Advisory TWSL2013-021: Multiple Vulnerabilities in Karotz Smart Rabbit Published: 08/01/13 Version: 1.0 Vendor: Electronic Arts http://www.ea.com/, formerly Mindscape, formerly Violet Product: Karotz Version affected: 12.07.19.00 Product description: Karotz is the...

Karotz Smart Rabbit 12.07.19.00 - Multiple Vulnerabilities

Trustwave SpiderLabs Security Advisory TWSL2013-021: Multiple Vulnerabilities in Karotz Smart Rabbit Published: 08/01/13 Version: 1.0 Vendor: Electronic Arts http://www.ea.com/, formerly Mindscape, formerly Violet Product: Karotz Version affected: 12.07.19.00 Product description: Karotz is the...

YOPMail XSS / Injection / HTTP Response Splitting

YOPMAILAnonymous&Free email address CRLF Injection-HTTP Response Spliting/XSS/Session Token in URL ================================================================================================================================================== Report-Timeline: ================ 2013-06-01:...

CVE-2013-3268

Novell iManager 2.7 before SP6 Patch 1 does not refresh a token after a logout action, which has unspecified impact and remote attack vectors...

Skype Account Service Session Token Bypass

Title: ====== Skype Account Service - Session Token Bypass Vulnerability Date: ===== 2012-11-15 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=762 http://www.vulnerability-lab.com/getcontent.php?id=739 MSRC ID: 13175 VL-ID: ===== 739 Common Vulnerability Scoring System...

Skype Account Service - Session Token Bypass Vulnerability

Document Title: =============== Skype Account Service - Session Token Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=762 http://www.vulnerability-lab.com/getcontent.php?id=739 MSRC ID: 13175 Release Date: ============= 2012-11-14...

Skype Account Service - Session Token Bypass Vulnerability

Document Title: =============== Skype Account Service - Session Token Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=762 http://www.vulnerability-lab.com/getcontent.php?id=739 MSRC ID: 13175 Release Date: ============= 2012-11-14...

Conceptronic Grab'n'Go and Sitecom Storage Center - Password Disclosure

Updated to include Sitecom MD-253 and MD254 Minor textual changes == Conceptronic Grab’n’Go and Sitecom Storage Center - Password disclosure Vulnerability - Security Advisory AA-002 Severity Rating: High Discovery Date: May 5, 2012 Vendor Notification: May 31, 2012 =Impact - System Access -...

CVE-2012-4581

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by...

Design/Logic Flaw

EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors...

Websense (Triton 7.6) Cross Site Scripting

======= Summary ======= Name: Websense Triton 7.6 reflected XSS in report management UI Release Date: 30 April 2012 Reference: NGS00137 Discoverer: Ben Williams Vendor: Websense Vendor Reference: Systems Affected: Risk: Medium Status: Fixed ======== TimeLine ======== Discovered: 24 October 2011...

NGS00137 Technical Advisory: Websense Triton 7.6 - reflected XSS in report management UI

======= Summary ======= Name: Websense Triton 7.6 reflected XSS in report management UI Release Date: 30 April 2012 Reference: NGS00137 Discoverer: Ben Williams [email protected] Vendor: Websense Vendor Reference: Systems Affected: Risk: Medium Status: Fixed ======== TimeLine ========...

Serv-U数据连接处理拒绝服务和会话令牌漏洞

BUGTRAQ ID: 50906 Serv-U是一种使用广泛的FTP服务器程序。 Serv-U在实现上存在安全漏洞，可被恶意用户利用造成拒绝服务并绕过某些安全限制。 1）在操作数据连接的监听套接字处理中存在错误，通过大量的FTP PASV命令，可耗尽可用的TCP端口，造成无法处理其他被动连接。 2）管理控制台会在管理员登录后生成较弱的会话令牌，这会允许枚举有效的令牌并通过FTP反弹攻击造成任意用户。成功利用此漏洞需要用户具有读写权限并让管理员打开控制台。 Serv-U 11.1.0.3 厂商补丁： RhinoSoft ---------...

CVE-2010-3319

IBM Records Manager RM 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file...

Information disclosure

IBM Records Manager RM 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file...

CVE-2010-3319

IBM Records Manager RM 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file...

CVE-2010-3319

IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, potentially allowing remote attackers to read a Referer log file and obtain sensitive information. Remediate by upgrading to 4.5.1.1-IER-FP001.

Simple Machines Forum 2.0 RC3 Cross Site Request Forgery

Exploit Title: Simple Machines Forum = 2.0 RC3 Sesc theft XSRF Date: 09-06-2010 Author: Xianur0 Software Link: http://download.simplemachines.org/ Version: =2.0 RC3 Tested on: 1.1.11 & 2.0 RC3 Vale, este "bug" es simple, y a decir verdad me parese bastante estupido, pero bueno... xD... El SMF en...

40 vulnerabilities in SMF 1.1.10/SMF 2.0RC2 by elhacker.net (Simple Audit)

This is the first batch of vulnerabilities found by the SimpleAudit team from elhacker.net http://labs.elhacker.net/simpleaudit Our goal is to evaluate the security of SMF 2.0 before using it on our own server, and we have found several security vulnerabilities. The vulnerabilities that also appl...

Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities

Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/35066/info Novell GroupWise WebAccess is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions or conduct cross-site scripting...