CVE-2014-1219

CA 2E Web Option r8.1.2 accepts a predictable substring of a W2ESSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to...

CA 2E Web Option 8.1.2 - Authentication Bypass

Vulnerability title: Unauthenticated Privilege Escalation in CA 2E Web Option CVE: CVE-2014-1219 Vendor: CA Product: 2E Web Option Affected version: 8.1.2 Fixed version: N/A Reported by: Mike Emery Details: CA 2E Web Option r8.1.2 and potentially others, is vulnerable to unauthenticated privilege...

CA 2E Web Option 8.1.2 - Authentication Bypass Vulnerability

Exploit for multiple platform in category web applications Details: CA 2E Web Option r8.1.2 and potentially others, is vulnerable to unauthenticated privilege escalation via a predictable session token. The POST parameter session token W2ESSNID appears as follows:...

CA 2E Web Option 8.1.2 - Authentication Bypass

CA 2E Web Option 8.1.2 - Authentication Bypass Vulnerability title: Unauthenticated Privilege Escalation in CA 2E Web Option CVE: CVE-2014-1219 Vendor: CA Product: 2E Web Option Affected version: 8.1.2 Fixed version: N/A Reported by: Mike Emery Details: CA 2E Web Option r8.1.2 and potentially...

CA 2E Web Option 8.1.2 Privilege Escalation / Denial Of Service

This is a multi-part message in MIME format. ------=NextPart00101CF280B.6C29886A Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Vulnerability title: Unauthenticated Privilege Escalation in CA 2E Web Option CVE: CVE-2014-1219 Vendor: CA Product: 2E Web...

CVE-2013-5450

IBM Security AppScan Enterprise 8.5 through 8.7.0.1, when Jazz authentication is enabled, allows man-in-the-middle attackers to obtain sensitive information or modify data by leveraging an improperly protected URL to obtain a session token...

Authentication flaw

IBM Security AppScan Enterprise 8.5 through 8.7.0.1, when Jazz authentication is enabled, allows man-in-the-middle attackers to obtain sensitive information or modify data by leveraging an improperly protected URL to obtain a session token...

CVE-2013-5450

IBM Security AppScan Enterprise 8.5 through 8.7.0.1, when Jazz authentication is enabled, allows man-in-the-middle attackers to obtain sensitive information or modify data by leveraging an improperly protected URL to obtain a session token...

CVE-2013-5450

CVE-2013-5450 affects IBM Security AppScan Enterprise versions 8.5 through 8.7.0.1 when Jazz authentication is enabled. The root issue is an improperly protected URL that can be leveraged in a man-in-the-middle scenario to obtain sensitive information or modify data by obtaining a session token. ...

ZeroShell cgi-binkerbynet - Local File Disclosure

ZeroShell cgi-binkerbynet - Local File Disclosure Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named "kerbynet" interpreted in cgi-bin directory here :...

ZeroShell 'cgi-bin/kerbynet' - Local File Disclosure

Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named "kerbynet" interpreted in cgi-bin directory here : /cdrom/usr/local/apache2/cgi-bin/kerbynet So all url look like this :...

ZeroShell 2.0RC2 File Disclosure / Command Execution

Exploit Title: ZeroShell = 2.0RC2 Local file disclosure and Remote Command Execution Date: 13/08/2013 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.zeroshell.org - www.zeroshell.org/download/ Version: 2.0RC2 Category: Local File disclosure and Remote Command Execution Google...

Karotz Smart Rabbit 12.07.19.00 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Multiple Vulnerabilities in Karotz Smart Rabbit Published: 08/01/13 Version: 1.0 Vendor: Electronic Arts http://www.ea.com/, formerly Mindscape, formerly Violet Product: Karotz Version affected: 12.07.19.00 Product description: Karotz is...

Karotz Smart Rabbit 12.07.19.00 Hijacking / Cleartext Token

Trustwave SpiderLabs Security Advisory TWSL2013-021: Multiple Vulnerabilities in Karotz Smart Rabbit Published: 08/01/13 Version: 1.0 Vendor: Electronic Arts http://www.ea.com/, formerly Mindscape, formerly Violet Product: Karotz Version affected: 12.07.19.00 Product description: Karotz is the...

Karotz Smart Rabbit 12.07.19.00 - Multiple Vulnerabilities

Karotz Smart Rabbit 12.07.19.00 - Multiple Vulnerabilities Trustwave SpiderLabs Security Advisory TWSL2013-021: Multiple Vulnerabilities in Karotz Smart Rabbit Published: 08/01/13 Version: 1.0 Vendor: Electronic Arts http://www.ea.com/, formerly Mindscape, formerly Violet Product: Karotz Version...

Karotz Smart Rabbit 12.07.19.00 - Multiple Vulnerabilities

Trustwave SpiderLabs Security Advisory TWSL2013-021: Multiple Vulnerabilities in Karotz Smart Rabbit Published: 08/01/13 Version: 1.0 Vendor: Electronic Arts http://www.ea.com/, formerly Mindscape, formerly Violet Product: Karotz Version affected: 12.07.19.00 Product description: Karotz is the...

YOPMail XSS / Injection / HTTP Response Splitting

YOPMAILAnonymous&Free email address CRLF Injection-HTTP Response Spliting/XSS/Session Token in URL ================================================================================================================================================== Report-Timeline: ================ 2013-06-01:...

CVE-2013-3268

Novell iManager 2.7 before SP6 Patch 1 does not refresh a token after a logout action, which has unspecified impact and remote attack vectors...

Skype Account Service Session Token Bypass

Title: ====== Skype Account Service - Session Token Bypass Vulnerability Date: ===== 2012-11-15 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=762 http://www.vulnerability-lab.com/getcontent.php?id=739 MSRC ID: 13175 VL-ID: ===== 739 Common Vulnerability Scoring System...

Skype Account Service - Session Token Bypass Vulnerability

Document Title: =============== Skype Account Service - Session Token Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=762 http://www.vulnerability-lab.com/getcontent.php?id=739 MSRC ID: 13175 Release Date: ============= 2012-11-14...