2099 matches found
CVE-2017-1152
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293...
Design/Logic Flaw
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293...
PT-2017-3096
Name of the Vulnerable Software and Affected Versions Trend Micro Threat Discovery Appliance version 2.6.1062r1 Description The issue allows a remote, unauthenticated attacker to delete arbitrary files as root due to directory traversal when processing a session id cookie. This can be used to...
CVE-2014-9691
Huawei Tecal vulnerabilities CVE-2014-9691 affect multiple Tecal server models (e.g., RH1288 V2, RH2265 V2, RH2288 V2, RH5885 etc.) and variants listed in the Huawei advisory. The issue is an information disclosure via the web UI Online Users page, allowing logged-in users’ session IDs to be view...
CVE-2014-9692
CVE-2014-9692 affects Huawei Tecal servers (multiple models listed in the Intel/ROM update lines) with a vulnerability in RMCP+ session ID handling. The RMCP+ session IDs can be inferred, enabling an attacker to impersonate legitimate users and gain access with forged identities. Public reference...
PT-2017-6384
Name of the Vulnerable Software and Affected Versions Huawei Tecal RH1288 V2 versions V100R002C00SPC107 and earlier Huawei Tecal RH2265 V2 version V100R002C00 Huawei Tecal RH2285 V2 versions V100R002C00SPC115 and earlier Huawei Tecal RH2268 V2 version V100R002C00 Huawei Tecal RH2288 V2 versions...
Cross site scripting
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9128: Improper Neutralization of Input During Web Page Generation
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
PT-2017-9965
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue is related to reflected XSS, where the affiliate-preview.php script in the www/admin directory is vulnerable to a reflected XSS attack. This could allow an attacker to steal the...
CVE-2017-6971
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862...
CVE-2017-6971
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862...
CVE-2017-6971: Improper Neutralization of Special Elements in Output Used by a Downstream Component
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862...
PT-2017-17435
Name of the Vulnerable Software and Affected Versions AlienVault USM and OSSIM versions prior to 5.3.7 NfSen versions prior to 1.3.8 Description The issue allows remote authenticated users to execute arbitrary commands in a privileged context or launch a reverse shell. This is achieved through...
Session fixation
Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...