Schneider Electric Pelco VideoXpert Missing Encryption

Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: 2.0.41 1.14.7 1.12.105 Summary: VideoXpert is a video management solution designed for scalability, fitting the needs surveillanc...

Schneider Electric Pelco VideoXpert Missing Encryption Vulnerability

Schneider Electric Pelco VideoXpert transmits sensitive data using double Base64 encoding for the Cookie 'authtoken' in a communication channel that can be sniffed by unauthorized actors or arbitrarily be read from the vxcore log file directly using directory traversal attack resulting in...

[ASA-201707-8] tor: session hijacking

Arch Linux Security Advisory ASA-201707-8 ========================================= Severity: Medium Date : 2017-07-11 CVE-ID : CVE-2017-0377 Package : tor Type : session hijacking Remote : Yes Link : https://security.archlinux.org/AVG-336 Summary ======= The package tor before version 0.3.0.9-1 ...

Pelco VideoXpert 1.12.105 - Information Disclosure

Pelco VideoXpert 1.12.105 - Information Disclosure Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: 2.0.41 1.14.7 1.12.105 Summary: VideoXpert is a video management solution...

Pelco VideoXpert 1.12.105 - Information Disclosure

Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: 2.0.41 1.14.7 1.12.105 Summary: VideoXpert is a video management solution designed for scalability, fitting the needs surveillanc...

Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information

Summary VideoXpert is a video management solution designed for scalability, fitting the needs surveillance operations of any size. VideoXpert Ultimate can also aggregate other VideoXpert systems, tying multiple video management systems into a single interface. Description The software transmits...

CVE-2017-7405

On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an attacker might be able to take over the administrative session without being prompted for...

Odoo OAuth Session Hijacking Vulnerability

Odoo formerly known as OpenERP is a product of the Belgian company Odoo, an Enterprise Resource Planning ERP and Customer Relationship Management CRM system; Odoo Community Edition is its Community Edition; Odoo Enterprise Edition is its Enterprise Edition; the OAuth module is one of the Open Web...

CVE-2017-6703

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, remote attacker to hijack another user's session. More Information: CSCvc90346. Known Affected Releases: 12.1...

CVE-2017-6703

The CVE-2017-6703 issue affects Cisco Prime Collaboration Provisioning Tool and describes a vulnerability in the web application that allows an unauthenticated, remote attacker to hijack another user’s session due to insufficient session management during authentication (session fixation). Affect...

EMC RSA Archer Cross-Site Scripting Vulnerability

EMC RSA Archer is an enterprise IT governance and compliance governance product from EMC Corporation EMC. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A cross-site scripting vulnerability exists in EMC RSA Archer. A...

ownCloud Error Page Cross-Site Scripting Vulnerability

ownCloud is the open source file synchronization and sharing solution. A cross-site scripting vulnerability exists in ownCloud, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions,...

Cisco Prime Collaboration Provisioning Tool Session Hijacking Vulnerability

Cisco Prime Collaboration Provisioning tool is a set of Web-based, next-generation communications services tools from Cisco. The tool provides IP communication services capabilities for IP telephony, voice mail and unified communications environments. A session hijacking vulnerability exists in t...

Ubiquiti Inc.: Privilege Escalation with Session Hijacking Having a Non-privileged Valid User

EdgeOS version 1.9.1.1 and prior, consequence of lack of protection if the file-system, exposing sensitive information, an attacker with access to an operator read-only account, can escalate privileges to admin root access in the system...

Cisco Prime Collaboration Provisioning Tool Session Hijacking Vulnerability

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, remote attacker to hijack another user's session. The vulnerability is due to insufficient session management during user authentication. An attacker could exploit this...

Sitecore 7.1 / 7.2 Cross Site Scripting

Sitecore 7.1-7.2 Cross Site Scripting Vulnerability Information -------------------- Author: Hamed Izadi Email: "hamedizadi", "@", "gmail", ".com"; Name: XSS Vulnerability in Sitecore Affected Software : Sitecore.NET Affected Versions: v7.2-7.1 and possibly below Vendor Homepage :...

Open-Xchange (OX) App Suite Multiple Cross Site Scripting Vulnerabilities (Jun 2017)

Open-Xchange OX App Suite is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

Open-Xchange (OX) Server Multiple Cross Site Scripting Vulnerabilities

Open-Xchange OX Server is prone to multiple cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2017-15521)

Elasticsearch Kibana is a suite of open source, browser-based tools for analyzing and searching Elasticsearch dashboards. A cross-site scripting vulnerability exists in Elasticsearch Kibana, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which...

Ubiquiti Inc.: Privilege Escalation: From operator to ubnt (and root) with non-interactive Session Hijacking

EdgeOS version 1.9.1 and prior, consequence of lack of protection if the file-system, exposing sensitive information, an attacker with access to an operator read-only account, can escalate privileges to admin root access in the system...