SolarWinds Serv-U MFT Information Disclosure Vulnerability

SolarWinds Serv-U MFT is a set of U.S. SolarWinds FTP server software. A security vulnerability exists in SolarWinds Serv-U MFT versions prior to 15.1.6 HFv1, which stems from the program assigning session tokens with low entropy values to authenticated users, and the program requesting the token...

CVE-2018-10240

SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session...

Session fixation

SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session...

HP Network Automation Cross-Site Scripting Vulnerability (CNVD-2018-12125)

HP Network Automation Software is network configuration and management automation software. A cross-site scripting vulnerability exists in HP Network Automation, which could be exploited by remote attackers to inject malicious script or HTML code that, when viewed with malicious data, could gain...

IBM Security QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2018-10456)

IBM Security QRadar SIEM applies security intelligence and perceptual analytics by consolidating, standardizing and correlating log and stream data to help prioritize security events and stay away from advanced threats. A cross-site scripting vulnerability exists in IBM Security QRadar SIEM, whic...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

Code execution vulnerability in TP-Link enterprise routers (CNVD-2018-08408)

Tplink ER5110G, Tplink ER5120G and Tplink WAR1300L are enterprise VPN routers and enterprise wireless VPN routers. A code execution vulnerability exists in TP-Link Enterprise Routers. An attacker can exploit the vulnerability to obtain the router's administrator username and password, or hijack a...

CVE-2018-6959

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

SAP Business Objects Session Fixation Vulnerability

SAP Business Objects is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The program provides reporting, performance management and data base and other functions. A session fixation vulnerability exists in SAP Business Objects that stems from the...

Navarino Infinity Session Fixation Vulnerability

Navarino Infinity is a maritime bandwidth management and optimization solution from Navarino Greece. The solution can be used to equip many types of vessels. A session fixation vulnerability exists in Navarino Infinity version 2.1.7. A remote attacker can exploit this vulnerability to hijack...

CVE-2018-8811

Cross-site request forgery CSRF vulnerability in system/workplace/admin/accounts/userrole.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users...

Stored cross-site scripting vulnerability in FineCMS core\M_Controller.php file

FineCMS is a small and medium-sized content management system based on PHP+MySql+CI framework. A stored cross-site scripting vulnerability exists in the FineCMS core\MController.php file. The vulnerability is due to the default situation in the FineCMS message board does not handle the input...

SAP BusinessObjects Web Intelligence Cross-Site Scripting Vulnerability

SAP BusinessObjects Germany SAP SAP a company provides a variety of business intelligence software, information management software, enterprise performance management solutions, regulatory, risk and compliance solutions. A cross-site scripting vulnerability exists in SAP BusinessObjects Web...

CVE-2017-12415

OXID eShop Community Edition before 6.0.0 RC2 development, 4.10.x before 4.10.5 maintenance, and 4.9.x before 4.9.10 legacy, Enterprise Edition before 6.0.0 RC2 development, 5.2.x before 5.2.10 legacy, and 5.3.x before 5.3.5 maintenance, and Professional Edition before 6.0.0 RC2 development, 4.9....

CVE-2017-12415

OXID eShop Community Edition before 6.0.0 RC2 development, 4.10.x before 4.10.5 maintenance, and 4.9.x before 4.9.10 legacy, Enterprise Edition before 6.0.0 RC2 development, 5.2.x before 5.2.10 legacy, and 5.3.x before 5.3.5 maintenance, and Professional Edition before 6.0.0 RC2 development, 4.9....

The vulnerability of Kaspersky Secure Mail Gateway’s email protection mechanism, which stems from the absence of a CSRF token in web forms, allows for the hijacking of the administrator’s session.

The vulnerability of Kaspersky Secure Mail Gateway’s email protection mechanism lies in the absence of a CSRF token in web forms. Exploiting this vulnerability allows an attacker to forge inter-site requests and intercept the administrator’s session...

Session fixation

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before the session times out. IBM X-Force ID: 134164...

CVE-2017-1693

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before the session times out. IBM X-Force ID: 134164...

CVE-2017-1693

IBM Integration Bus versions 9.0.0.0–9.0.0.8 and 10.0.0.0–10.0.0.9 are affected by CVE-2017-1693, which allows session hijacking if an attacker has a valid session ID, during a short window before timeout. The IBM Security Bulletin confirms remediation via APAR IT21158, with fixes available in 9....

CVE-2017-1693

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before the session times out. IBM X-Force ID: 134164...