2231 matches found
Session fixation
IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for...
CVE-2014-3092
CVE-2014-3092 affects IBM Jazz Team Server-based products (e.g., Rational CLM suite, RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM) where the session cookie is not marked Secure in HTTPS, enabling potential cookie leakage over HTTP. The root cause is the cookie’s missing Secure flag during SSL s...
CVE-2014-3092
IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for...
CVE-2014-0909
The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...
CVE-2014-0909
The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...
CVE-2014-0909
The IBM Rational License Key Server (RLKS) Administration and Reporting Tool, versions 8.1.4.x prior to 8.1.4.4, is affected by CVE-2014-0909 due to not setting the secure flag on the session cookie in SSL mode. This allows an attacker to potentially capture the cookie by intercepting traffic in ...
Ribose Cross Site Request Forgery
Hi Team, Please find the attached description and the PoC for the vulnerability identified. Vulnerability: CSRF Attack on Ribose Online Social Collaboration Platform Date: 13/08/2014 Author: JoeV Vendor: www.ribose.com Tested on: Windows 7 Description: A CSRF attack forces a logged-on victim’s...
CVE-2014-0174
Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...
CVE-2014-0174
Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...
Moderate: Red Hat Security Advisory: Red Hat Enterprise MRG 2.5 Messaging and Grid security update
An updated cumin package that fixes two security issues is now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...
CVE-2014-2509
Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...
Session fixation
Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...
CTERA 3.2.29.0 and 3.2.42.0 - Stored XSS
No description provided by source. 恶意用户可以修改项目文件夹描述进行XSS攻击和HTML注入（添加链接、图片和按钮等）。 因为项目文件夹时被不同用户共享，该漏洞可以用来抓取会话cookie。 创建一个项目文件夹并添加下面的描述（根据版本修改特定路径）：...
Citrix Nfuse 1.6 Published Applications Information Leak Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3926/info Citrix Nfuse is an application portal server meant to provide the functionality of any application on the server via a web browser. Nfuse works in conjunction with a previously-installed webserver. If a request...
XFree86 X11R6 3.3 XDM Session Cookie Guessing Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2985/info xdm is the X Display Manager, a component of the XFree86 package. xdm manages the display of X sessions both locally and remotely. An xdm server compiled without WrapHelp.c is vulnerable to a brute force X cooki...
ASP Portal Multiple Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/9659/info ASP Portal has been reported to be prone to multiple vulnerabilities. The first issue results from a lack of sufficient sanitization performed on user supplied data that is later incorporated into dynamic conten...
MaxWebPortal 1.30 Remote Database Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/7837/info A number of vulnerabilities have been discovered in the MaxWebPortal. The issues that have been discovered include: MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An...
Ruby on Rails Known Secret Session Cookie Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
MaxWebPortal 1.30 search.asp Search Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/7837/info A number of vulnerabilities have been discovered in the MaxWebPortal. The issues that have been discovered include: MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An...