CMS Made Simple adminaddgroup.php file cross-site scripting vulnerability

CMS Made Simple is a free web-based content publishing system. A cross-site scripting vulnerability exists in the CMS Made Simple adminaddgroup.php file, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensiti...

Apache NiFi Cross-Site Scripting Vulnerability (CNVD-2017-14424)

Apache NiFi is a system data flow automation solution. Apache NiFi suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user sessions...

CVE-2016-7809

Cross-site request forgery CSRF vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows remote attackers to hijack the authentication of logged in user to conduct unintended operations via unspecified vectors...

CVE-2016-9977

CVE-2016-9977 affects IBM Maximo Asset Management core products 7.1, 7.5, and 7.6 (and related Industry Solutions and IBM Control Desk on top) with a vulnerability that allows remote session hijacking due to failure to invalidate an existing session identifier. Affected products include Maximo As...

CVE-2016-9977

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253...

XSS cross-site scripting vulnerability in the 'language' parameter of UFIDA U8+ system

UFIDA U8+ is to support enterprises to realize multi-end PC, cell phone, tablet and other devices multi-system windows, iOS, Android and other mainstream systems application deployment of business software. An XSS cross-site scripting vulnerability exists in the 'language' parameter of the UFIDA...

Multiple vulnerabilities in FortiPortal (CNVD-2017-10727)

FortiPortal is Fortinet's advanced, feature-rich hosted security analytics and management enabler that serves as an MSP for VM software solutions/products that can be deployed on hosted service infrastructures. FortiPortal has multiple security vulnerabilities. The vulnerabilities can be exploite...

Code injection

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...

CVE-2017-1170

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230...

CVE-2017-1170

CVE-2017-1170 affects IBM WebSphere Commerce 8.0 (Enterprise, Professional, Express, Developer). A local user can hijack another user’s session, indicating a local elevation of privileges with partial confidentiality/integrity/availability impact. The provided documents do not specify the root ca...

CVE-2017-1170

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230...

CVE-2016-8924

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537...

CVE-2016-2564

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

CVE-2016-2564

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

Design/Logic Flaw

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

CVE-2016-2564

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

CVE-2016-2564

Affected product: Invision Power Services (IPS) Community Suite

CVE-2017-7284

An attacker that has hijacked a Unitrends Enterprise Backup before 9.1.2 web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover...

ASUS WRT Session Hijacking Nmap NSE Script

local http = require "http" local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local vulns = require "vulns" local nmap = require "nmap" description = ASUSWRT is a wireless router operating system that powers many routers produced by ASUS. Sessio...

CVE-2016-8789

Huawei eSpace Integrated Access Device IAD with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS...