AirDroid Patches Vulnerability Exposing Android Data

A critical vulnerability impacting 50 million Android users running the popular AirDroid application has been patched. AirDroid, an app that allows you link an Android device to a computer and send SMS messages, run apps and add contacts via a Wi-Fi connected web browser, released the patch Jan...

Cisco Unified Communications Manager Denial of Service Vulnerability (CNVD-2015-08374)

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A security vulnerability exists in the Identi...

Janitza UMG Session Token Flaw Vulnerability

The Janitza UMG is an online power quality monitor for the energy industry from Janitza Germany. Janitza UMG 508, 509, 511, 604,605 has a session-token flaw. Allows a remote attacker to perform calculations on the session-token value and determine the PIN value...

CVE-2015-3973

Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine a PIN value via unspecified computations on session-token values...

Symantec Endpoint Protection ConsoleServlet ResetPassword Policy Bypass (CVE-2015-1486)

An authentication bypass vulnerability exists in Symantec Endpoint Protection. This vulnerability is due to a design flaw that lets unauthenticated users to retrieve a valid session token. A remote, unauthenticated attacker may exploit this vulnerability to create an admin account and access the...

ownCloud: s2.owncloud.com: SSL Session cookie without secure flag set

URL: https://s2.owncloud.com/ Issue detail The following cookie was issued by the application and does not have the secure flag set: sessionid=0fdc40cc016d1e70b1567b0071e5dcd2; expires=Sat Aug 22 03:45:12 2015; path=/; domain=s2.owncloud.com; max-age=86387; httponly The cookie appears to contain ...

Janitza UMG Power Quality Measuring Products Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on September 22, 2015, and is being released to the NCCIC/ICS-CERT web site. Mattijs van Ommeren of Applied Risk has identified several vulnerabilities in the Janitza UMG power quality measuring products. Janitza ha...

SUSE-SU-2015:1300-1 Security update for novnc

novnc was updated to fix a session hijacking problem through insecurely set session token cookies bnc922233, CVE-2013-7436. Security Issues: CVE-2013-7436...

Heroku API - Re Auth Session Token Bypass Vulnerability

Document Title: =============== Heroku API - Re Auth Session Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1336 View: https://www.youtube.com/watch?v=1WpWVVXVUSs Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1323 Release Date:...

ESC 8832 Data Controller - Multiple Vulnerabilities

ESC 8832 Data Controller - Multiple Vulnerabilities =begin Exploit Title: ESC 8832 Data Controller multiple vulnerabilities Date: 2014-05-29 Platform: SCADA / Web Application Exploit Author: Balazs Makany Vendor Homepage: www.envirosys.com Version: ESC 8832 Data Controller Hardware Tested on: ESC...

Vesta Control Panel 0.9.8 Cross Site Request Forgery

Exploit Title: Vesta Control Panel CSRFchange admin password Date: 24-05-2015 Exploit Author: Ben Khlifa Fahmi Vendor Homepage: https://vestacp.com/ Software Link: http://vestacp.com/pub/vst-install.sh Version: 0.9.8amd64 Tested on: ubuntu trusty 14.04 Description:...

Grindr for iOS Session Token Remote Password Manipulation Vulnerability

Grindr for iOS is GPS based mobile app. A security vulnerability in the Grindr for iOS reset password feature allows attackers to exploit the vulnerability to intercept session tokens, change email values, and reset passwords...

Shopify: SSL cookie without secure flag set

hello shopify security team, I have found security vulnerability. Vulnerable URL :- https://app.shopify.com/services/signup/track/ The following cookie was issued by the application and does not have the secure flag set: signupsessionid=0875b12b680173807271e6c444a964e8; path=/; expires=Mon, 04 Ma...

MGASA-2015-0133 Updated novnc packages fix CVE-2013-7436

Updated novnc package fixes security vulnerability: noVNC before 0.5.1 allows an attacker to steal insecurely set session token cookies, hijacking active or inactive VNC sessions CVE-2013-7436...

Updated novnc packages fix CVE-2013-7436

Updated novnc package fixes security vulnerability: noVNC before 0.5.1 allows an attacker to steal insecurely set session token cookies, hijacking active or inactive VNC sessions CVE-2013-7436...

Cross-Site Scripting vulnerability in Websense Data Security block page

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Websense Data Security block page ------------------------------------------------------------------------ Han Sahin, September 2014...

Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting

------------------------------------------------------------------------ Citrix NITRO SDK xenhotfix page is vulnerable to Cross-Site Scripting ------------------------------------------------------------------------ Han Sahin, August 2014...

EMC M&R (Watch4net) Centralized Management Console XSS Vulnerability

A cross site scripting vulnerability was found in EMC M&R Watch4net Centralized Management Console. This issue allows attackers to perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, logging their...

EMC M&R (Watch4net) Alerting Frontend XSS Vulnerability

A cross site scripting vulnerability was found in EMC M&R Watch4net Alerting Frontend. This issue allows attackers to perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, logging their keystrokes, or exploi...

Vimeo: Vimeo.com - reflected xss vulnerability

Hi. I want to report a Reflected xss vulnerability that I found in www.vimeo.com website and which can affect the safety of your users. This vulnerability allows an attacker to inject in web pages javascript content for sending malicious scripts to an unsuspecting user. This flaw can access any...