DEBIAN-CVE-2016-5696

net/ipv4/tcpinput.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack...

CVE-2016-5696

net/ipv4/tcpinput.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack...

CVE-2016-1607

Multiple cross-site request forgery CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request...

Collectd-web 'ajax_post.php' cross-site scripting vulnerability

Collectd-web is a set of web-based front-end tools for collectd to collect RRD data. Collectd-web suffers from a cross-site scripting vulnerability that allows remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

BitTorrent Cross-Site Scripting Vulnerability

BitTorrent is a set of peer-to-peer file uploading and downloading software based on the BitTorrent protocol. BitTorrent suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain...

Drupal Fieldable Panels Panes (FPP) Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal Fieldable Panels Panes FPP, which allows remote attackers to exploit the vulnerability to inject malicious script or...

CVE-2016-0340

IBM Security Identity Manager ISIM Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

CVE-2016-0340

IBM Security Identity Manager ISIM Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation...

IBM Forms Server Cross-Site Scripting Vulnerability

IBM Forms Server is the United States IBM's set of scalable document-based form application of electronic form automation software. A cross-site scripting vulnerability exists in IBM Forms Server that stems from the program's failure to adequately filter user-submitted input. An attacker could...

CVE-2016-2889

Cross-site request forgery CSRF vulnerability in the Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrar...

CVE-2016-0315

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

Design/Logic Flaw

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

CVE-2016-0315

The Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation...

IBM Jazz Reporting Service (JRS) Session Hijacking Vulnerability

IBM Jazz Reporting Service is an optional component of IBM Rational Reporting for Development Intelligence. IBM Jazz Reporting Service JRS has a security vulnerability in the Report Builder and Data Collection Component DCC implementations due to the program retaining session ID validity after...

USN-3024-1 tomcat6, tomcat7 vulnerabilities

It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote attacker could use this issue to possibly list a parent directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu...

Symphony CMS Session Fixation Vulnerability

Symphony CMS is a content management system developed in PHP and MySQL. A session fixation vulnerability exists in Symphony CMS when session.useonlycookies is enabled in the program, which can be exploited by a remote attacker to hijack a web session by submitting the PHPSESSID parameter...

CVE-2016-0386

Cross-site request forgery CSRF vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to hijack the authentication of administrators for requests that delete employees...

VMware vRealize Log Insight Cross-Site Scripting Vulnerability

VMware vRealize Log Insight is a suite of log management and analysis tools. A cross-site scripting vulnerability in VMware vRealize Log Insight allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information ...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2016-04109)

Adobe ColdFusion is a dynamic Web server product that runs CFML, a programming language for Web applications. A cross-site scripting vulnerability exists in Adobe ColdFusion, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

Code injection

EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors...