Landesk Management Suite 'serverlist_grouptree.aspx' Cross-Site Scripting Vulnerability

Landesk Management Suite is a system management solution. A cross-site scripting vulnerability exists in Landesk Management Suite 'serverlistgrouptree.aspx', which can be exploited by a remote attacker to construct a malicious URI and trick a user into parsing it, which can be used to obtain a...

Multiple Cisco Products Cross-Site Scripting Vulnerabilities

Cisco AnyConnect Secure Mobility Client is a mobile client VPN tool.Cisco HostScan Engine is a host scanning engine. Cisco AnyConnect Secure Mobility Client and Cisco Host Scan fail to properly validate URLs used to construct applet paths in the DOM, allowing attackers to conduct cross-site...

Asus RT-N10 Plus Router 'flag' parameter cross-site scripting vulnerability

The Asus RT-N10 Plus Router is a router device. A cross-site scripting vulnerability exists in the handling of the 'flag' parameter in the Asus RT-N10 Plus Router, which can be exploited by a remote attacker to construct a malicious URI and trick the user into parsing it, which can be used to...

FancyFon FAMOC Session Fixation Vulnerability

FancyFon FAMOC is a mobile device management platform. FancyFon FAMOC suffers from a session fixation vulnerability that can be exploited by an attacker to hijack arbitrary sessions and gain unauthorized access in affected applications...

TechSmith Camtasia Open Redirect Vulnerability

TechSmith Camtasia a tool specialized in recording screen actions, it can easily record screen actions in any color mode, including images, sound effects, mouse tracks, narration sounds and more. An open redirection vulnerability exists in TechSmith Camtasia, which can be exploited by remote...

Mozilla Firefox/Thunderbird/SeaMonkey Proxy Authentication Session Fixation Vulnerability

Firefox/Thunderbird/SeaMonkey are web browsers and mail/newsgroup clients released by Mozilla. A session fixation vulnerability exists in Mozilla Firefox/Thunderbird/SeaMonkey, which can be exploited by an attacker to hijack arbitrary sessions and gain unauthorized access to affected applications...

Softbb.net SoftBB 'redir_last_post_list.php' cross-site scripting vulnerability

Softbb.net SoftBB is a WEB based application. Softbb.net SoftBB 'redirlastpostlist.php' suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack...

Croogo CMS Cross-Site Scripting Vulnerability

Croogo CMS is a content management system. Croogo CMS suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform malicious...

Tapatalk for WoltLab Burning Board 'welcome.php' Has Multiple Cross-Site Scripting Vulnerabilities

WoltLab Burning Board is a forum program and Tapatalk is a plug-in application. Tapatalk for WoltLab Burning Board 'welcome.php' has a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to...

ZfcUser 'redirect' parameter cross-site scripting vulnerability

ZfcUser is a user registration and authentication module for Zend Framework 2. A cross-site scripting vulnerability exists in ZfcUser's handling of the 'redirect' parameter, which can be exploited by a remote attacker to construct a malicious URI and trick the user into parsing it, which can be...

DFLabs PTK Cross-Site Request Forgery Vulnerability

DFLabs PTK is a powerful collection of digital investigative, forensic tools. A cross-site request forgery vulnerability exists in versions of DFLabs PTK prior to 1.0.5, which allows remote attackers to hijack an administrator's or researcher's authentication to trigger a logout request...

WordPress Plugin TwitterDash Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A cross-site request forgery vulnerability exists in the WordPress plugin TwitterDash, which allows remote attackers to hijack the...

CVE-2014-9386

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...

CVE-2014-9015

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...

Cross site request forgery (csrf)

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...

CVE-2014-9015

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...

[SECURITY] [DSA 3075-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3075-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 20, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3075-1 (drupal7 - security update)

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2014-9015 Aaron Averill discovered that a specially crafted request can give a user access to another user OpenVAS...

USN-2347-1 python-django vulnerabilities

Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...

Code injection

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...