4060 matches found
CVE-2013-0937
CVE-2013-0937 is a session-fixation vulnerability affecting EMC Documentum Webtop, WDK, Taskspace, and Records Manager up to version 6.7 SP2. The entry describes that remote attackers could hijack an authenticated session via unspecified vectors. Affected components include Webtop, WDK, Taskspace...
[SECURITY] CVE-2013-2067 Session fixation with FORM authenticator
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-2067 Session fixation with FORM authenticator Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.32 - - Tomcat 6.0.21 to 6.0.36 Description: FORM authentication associates the most recent...
CVE-2013-2067
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...
ESA-2013-021: EMC Documentum Multiple Vulnerabilities
ESA-2013-021.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-021: EMC Documentum Multiple Vulnerabilities EMC Identifier: ESA-2013-021 CVE Identifier: CVE-2013-0937, CVE-2013-0938, CVE-2013-0939 Severity Rating: See below for individual scores Affected products: • EMC Documentum Webtop...
EMC Documentum multiple security vulnerabilities
Session fixation, crossite scripting...
Apache Tomcat security vulnerabilities
DoS, session fixation, information leakage...
UBUNTU-CVE-2013-2067
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...
Fixed in Apache Tomcat 6.0.37
Important: Session fixation CVE-2013-2067 FORM authentication associates the most recent request requiring authentication with the current session. By repeatedly sending a request for an authenticated resource while the victim is completing the login form, an attacker could inject a request that...
Oracle WebCenter Sites Satellite Server - HTTP Header Injection
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: HTTP header injection/Cache poisoning in Oracle WebCenter Sites Satellite Server product: Oracle WebCenter Sites Satellite Server former FatWire Satellite Server vulnerab...
Oracle WebCenter Sites Satellite Server - HTTP Header Injection
Exploit for windows platform in category web applications Vendor description: ------------------- FatWire Satellite Server is a predecessor product of Oracle WebCenter Sites Satellite Server. "Oracle WebCenter Sites Satellite Server enables organizations to deliver segmented, targeted, and...
Oracle WebCenter Sites Satellite Server - HTTP Header Injection
Oracle WebCenter Sites Satellite Server - HTTP Header Injection SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: HTTP header injection/Cache poisoning in Oracle WebCenter Sites Satellite Server product: Oracle WebCenter...
MediaWiki 会话固定漏洞(CVE-2012-5391)
BUGTRAQ ID: 58019 CVECAN ID: CVE-2012-5391 MediaWiki是著名的wiki程序，运行于PHP+MySQL环境。 MediaWiki 1.20及其他版本在实现上存在会话固定漏洞，攻击者可利用此漏洞劫持任意会话，获取未授权访问权限等。 0 MediaWiki 1.20 厂商补丁： MediaWiki --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://wikipedia.sourceforge.net/...
[PT-2012-53] Privilege Gaining in DataLife Engine
----------------------------------------------------------- PT-2012-53 Positive Technologies Security Advisory Privilege Gaining in DataLife Engine ----------------------------------------------------------- --- Vulnerable software DataLife Engine Version: 9.7 and earlier Application link:...
DataLife Engine 9.7 Session Fixation
----------------------------------------------------------- PT-2012-53 Positive Technologies Security Advisory Privilege Gaining in DataLife Engine ----------------------------------------------------------- --- Vulnerable software DataLife Engine Version: 9.7 and earlier Application link:...
Session fixation
The Session Manager in IBM Sterling Connect:Direct through 4.1.0.3 on UNIX allows remote attackers to cause a denial of service daemon crash and disk consumption via crafted data...
RHEL 5 : Red Hat Network Satellite Server (RHSA-2011:0300)
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0300 advisory. Red Hat Network Satellite Server RHN Satellite Server is a system management tool for Linux-based infrastructures. It allows for the...
MediaWiki < 1.18.6 / 1.19.3 / 1.20.1 Multiple Vulnerabilities
According to its version number, the instance of MediaWiki running on the remote host is affected by multiple security vulnerabilities : - MediaWiki core is vulnerable to session fixation attacks that allow an attacker to compromise another user's account. CVE-2012-5391 - The MediaWiki CentralAut...
Axis2 -- Security vulnerabilities on dependency Apache HttpClient
Apache Axis2 reports: Apache Axis2 1.7.4 is a maintenance release that includes fixes for several issues, including the following security issues: Session fixation AXIS2-4739 and XSS AXIS2-5683 vulnerabilities affecting the admin console. A dependency on an Apache HttpClient version affected by...
