2108 matches found
Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-16525)
Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. A cross-site scripting vulnerability in Open-Xchange OX App Suite allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...
The vulnerability of the session management function in the web interface of Cisco microprogramming software for routers of the Small Business RV320 and RV325 series allows a hacker to gain control over an existing user session.
The vulnerability of the session management function in Cisco microprogramming system routers of the Small Business RV320 and RV325 series is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain control over...
Siemens SCALANCE X-200IRT Switches < 5.2.0 Session Hijack
Binary data 720058.prm...
Session fixation
A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. An attacker could use this impersonated...
CVE-2019-1724
A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. An attacker could use this impersonated...
PT-2019-12363 · Pulse · Pulse Policy Secure +1
Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions 9.0RX before 9.0R3.4 Pulse Connect Secure versions 8.3RX before 8.3R7.1 Pulse Policy Secure versions 9.0RX before 9.0R3.2 Pulse Policy Secure versions 5.4RX before 5.4R7.1 Description: An unauthenticated, remote...
Session fixation
Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...
Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.7 security update
A security update is now available for Red Hat Single Sign-On 7.2 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
keycloak: session hijack using the user access token
Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...
Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.7 security update on RHEL 6
Security updates for Red Hat Single Sign-On 7.2.7 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
keycloak: session hijack using the user access token
Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...
keycloak: session hijack using the user access token
Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...
Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.7 security update on RHEL 7
Security updates for Red Hat Single Sign-On 7.2.7 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2017-12619
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...
Stored Cross-Site Scripting Vulnerability in JYmusic Frontend
JYmusic is an open source cross-platform music management system. JYmusic frontend has a stored cross-site scripting vulnerability, an attacker can insert malicious js code in the page to obtain user cookies and other information, resulting in user hijacking...
CVE-2018-0382
A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected...
ISPsystem COREmanager Authentication Bypass
An authentication bypass vulnerability exists in ISPsystem COREmanager. A remote attacker could exploit this flaw by sending specially crafted packets to the affected server. Successful exploitation of this vulnerability would allow a remote attacker to hijack a user's session and escalating thei...
UBUNTU-CVE-2019-9499
The implementations of EAP-PWD in wpasupplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection...
SuiteCRM 7.x <= 7.8.23 and 7.10.x <= 7.10.10 XSS Vulnerability
SuiteCRM is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2019-5523
VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently...