2095 matches found
Facebook BBP #23 - Session ID & CSRF Vulnerability
Document Title: =============== Facebook BBP 23 - Session ID & CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1432 Facebook Security ID: 10202805822321483 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Vulnerability Magazine:...
Facebook BBP - Session ID & CSRF Vulnerability
Document Title: =============== Facebook BBP - Session ID & CSRF Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1433 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1432 Vulnerability Magazin...
Facebook BBP - Session ID & CSRF Vulnerability
Document Title: =============== Facebook BBP - Session ID & CSRF Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1433 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1432 Vulnerability Magazin...
CVE-2 0 1 4-8 2 7 2 vulnerability analysis: Dell Remote Control Card vulnerability in the Session-ID mechanism-vulnerability warning-the black bar safety net
! We recently found a Dell integrated Remote Control CardiDRACthe vulnerability, Dell integrated remote control card is integrated in the server on small devices. Hackers use this number for theCVE-2 0 1 4-8 2 7 2 vulnerabilities inlow permissions or not the authentication of the case, to enable ...
Oracle Solaris Third-Party Patch Update : tomcat (multiple_vulnerabilities_in_apache_tomcat3)
The remote Solaris system is missing necessary patches to address security updates : - java/org/apache/coyote/http11/InternalNioInputBuffer.jav a in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows...
Dell iDRAC IPMI 1.5 Insufficient Session ID Randomness
""" For testing purposes only. c Yong Chuan, Koh 2014 """ from time import sleep from socket import from struct import from random import import sys, os, argparse HOST = None PORT = 623 bufsize = 1024 recv = "" create socket UDPsock = socketAFINET,SOCKDGRAM UDPsock.settimeout2 data = 21 offset of...
Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness
Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness """ For testing purposes only. c Yong Chuan, Koh 2014 """ from time import sleep from socket import from struct import from random import import sys, os, argparse HOST = None PORT = 623 bufsize = 1024 recv = "" create socket UDPsock =...
Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness
""" For testing purposes only. c Yong Chuan, Koh 2014 """ from time import sleep from socket import from struct import from random import import sys, os, argparse HOST = None PORT = 623 bufsize = 1024 recv = "" create socket UDPsock = socketAFINET,SOCKDGRAM UDPsock.settimeout2 data = 21 offset of...
Security Advisory-Multiple Vulnerabilities on Huawei Tecal
Some Huawei server products have multiple security vulnerabilities. 1.Some Huawei server products have the sensitive information leak vulnerability. Users who log in to the products can view the sessions IDs of all online users on the Online Users page of the web UI. Attackers can also view the...
CVE-2014-8272
CVE-2014-8272 affects Dell iDRAC6 (modular before 3.65; monolithic before 1.98) and iDRAC7 before 1.57.57, where IPMI 1.5 session ID values are not properly randomized or selected, enabling remote attackers to brute-force session IDs and execute arbitrary commands. The vulnerability is remote (ne...
CVE-2014-8272: Undefined Security Weakness
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack...
CVE-2014-9386: Undefined Security Weakness
Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...
PT-2014-8978
Name of the Vulnerable Software and Affected Versions Zenoss Core versions prior to 4.2.5 SP161 Description The issue allows remote attackers to hijack sessions by leveraging an unattended workstation, as the session ID cookie has an infinite lifetime. Recommendations For versions prior to 4.2.5...
CVE-2014-3684
The tmadopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager aka TORQUE Resource Manager 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary...
PT-2014-5532
Name of the Vulnerable Software and Affected Versions Centreon versions 2.5.1 through 2.5.2 Centreon Enterprise Server version 2.2 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the session id or template id parameter, related to the comman...
PT-2014-5531
Name of the Vulnerable Software and Affected Versions Centreon versions 2.5.1 through 2.5.2 Centreon Enterprise Server version 2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the index id parameter to...
Session ID URL's in logfile
Hi, In the logfiles you can see the session ID's in the URL. Can this be used to hack into a another account?...
Session ID URL's in logfile
Hi, In the logfiles you can see the session ID's in the URL. Can this be used to hack into a another account?...
Supermicro Onboard IPMI Port 49152 敏感文件泄露漏洞
关于 IPMI：智能平台管理接口 IPMI 是一种开放标准的硬件管理接口规格，定义了嵌入式管理子系统进行通信的特定方法。IPMI 信息通过基板管理控制器 BMC（位于 IPMI 规格的硬件组件上）进行交流。IPMI是智能型平台管理接口（Intelligent Platform Management Interface）的缩写，是管理基于...
