CVE-2018-6959

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

CVE-2018-6959

CVE-2018-6959 affects VMware vRealize Automation (vRA) prior to 7.4.0, with a vulnerability in handling of session IDs that may allow hijacking a valid vRA user session. The Nessus/NVE and VMware advisory entries show affected versions up to 7.3.x (7.0.x–7.3.x) and indicate remediation via update...

VMware vRealize Automation Session Hijacking Vulnerability

VMware vRealize Automation vRA is a suite of cloud automation software from VMware. The software supports automated delivery of personalized infrastructure, deployment across multi-vendor, hybrid cloud infrastructures, simplified application release automation and continuous delivery. A session...

Design/Logic Flaw

The web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-8422

The web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-8422

The CVE-2014-8422 entry affects Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices prior to R3.32.0, where the web-based management (WBM) interface generates session cookies with insufficient entropy, enabling remote attackers to hijack sessions via brute-force. The provi...

CVE-2014-8422

The web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

SAP Cloud Platform Session Fixation Vulnerability

SAP Cloud Platform is an open Platform-as-a-Service PaaS cloud platform from SAP. The platform is used to build and extend personalized, collaborative and mobile-enabled cloud applications. A session fixation vulnerability exists in SAP Cloud Platform version 2.0, which stems from the program...

[ASA-201804-4] apache: multiple issues

Arch Linux Security Advisory ASA-201804-4 ========================================= Severity: Medium Date : 2018-04-04 CVE-ID : CVE-2017-15710 CVE-2017-15715 CVE-2018-1283 CVE-2018-1301 CVE-2018-1302 CVE-2018-1303 CVE-2018-1312 Package : apache Type : multiple issues Remote : Yes Link :...

Mail.ru: Partner Account Takeover on https://www.delivery-club.ru через пользовательский аккаунт.

Improper access control allowed user account to perform privileged actions for partner's account with same ID. Ситуация аналогичная с 324230, но в другую сторону. Можно захватывать партнерские аккаунты посредством сессии с основного сайта...

Sandoba CP:Shop CMS 2016.1 Cross Site Scripting

Document Title: =============== Sandoba CP:Shop CMS v2016.1 - Multiple Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2122 Release Date: ============= 2018-03-02 Vulnerability Laboratory ID VL-ID:...

LDAP Account Manager 6.2 Cross Site Scripting

Affected Software: LDAP Account Manager 6.2 Pentester: MichaA KAdzior CVE: CVE-2018-8763, CVE-2018-8764 Vulnerabilities : 1. Cross-site scripting reflected CVE-2018-8763 : ================================ Risk: HIGH Summary: Reflected Cross Site Scripting vulnerability has been found during the...

WolfCMS Cross-Site Scripting Vulnerability

Wolf CMS is a lightweight content management system written in PHP. A reflective cross-site scripting vulnerability exists in WolfCMS 0.8.3.1 in the "Create New File" and "Create New Directory" input boxes under the "File" tab. An attacker can exploit this vulnerability to conduct session...

CVE-2018-1000087

WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker c...

CVE-2018-1000087

WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker c...

Cross site scripting

WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker c...

Session Hijacking Vulnerability in Multiple Belden Hirschmann Switch Products

Belden Hirschmann RS, etc. are switch products of Belden USA. A session fixation vulnerability exists in the web interface in several Belden Hirschmann switch products. An attacker can exploit this vulnerability to hijack a web session...

Trend Micro Smart Protection Server Session Hijacking Via Log File Disclosure

The Trend Micro Smart Protection Server running on the remote host is affected by a session hijacking vulnerability due to the disclosure of session IDs in the diagnostic.log file that can be accessed via HTTP without authentication. An unauthenticated, remote attacker can grab the log file and...

CVE-2018-5465

A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fixation vulnerability in the web interface has been identified, which may allow an attacker to hijack web sessions...

IBM Maximo Asset Management Session Hijacking Vulnerability (CNVD-2018-06328)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A session...