CVE-2016-1000219

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield...

CVE-2016-1000219

CVE-2016-1000219 affects Kibana prior to 4.5.4 and 4.1.11. When a custom output is configured for logging in, cookies and authorization headers could be written to Kibana log files, enabling a local attacker to hijack sessions of other users in environments using authentication like Shield. The p...

Composr CMS v10.0.0 XSS Vulnerability

Composr CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:composr:cms";...

123ContactForm - Cross Site Scripting Web Vulnerability

Document Title: =============== 123ContactForm - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1982 Ref: 123-1476631846 Release Date: ============= 2017-06-12 Vulnerability Laboratory ID VL-ID:...

Craft CMS 2.6 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip...

CVE-2016-9977

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253...

CVE-2016-9977

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253...

Code injection

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253...

Craft CMS 2.6 Cross Site Scripting / File Upload

Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip Version: 2.6 Tested on: Kali Linux 2.0 | Windows 8.1...

Perch v3.0.3 CMS - Multiple Web Vulnerabilities

Document Title: =============== Perch v3.0.3 CMS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2067 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15948 CVE-ID: ======= CVE-2017-15948 Release Date: ============...

IBM Tivoli Federated Identity Manager Cross-Site Scripting Vulnerability (CNVD-2017-09951)

IBM Tivoli Federated Identity Manager is a cross-enterprise federated identity management product from IBM USA. A cross-site scripting vulnerability in IBM Tivoli Federated Identity Manager allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be...

Verizon Patches XSS Issues in its Messaging Client

Verizon late last year patched a vulnerability in its Message+ messaging client that could have allowed an attacker to take over a session and possibly extend their reach into a user’s account management settings. Researcher Randy Westergren yesterday disclosed some details on the bug, which coul...

McAfee Network Data Loss Prevention Session Hijacking Vulnerability (CNVD-2017-07550)

McAfee Network Data Loss Prevention is a data leakage protection solution. McAfee Network Data Loss Prevention NDLP suffers from a session-side hijacking vulnerability in the server implementation, which can be exploited by remote attackers to view, add, and delete users by modifying HTTP request...

CVE-2017-4014

Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request...

CVE-2017-4014

Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request...

XSS in SAP NetWeaver AS Java SRM

Application: SAP SRM Versions Affected: SAP SRM 701 – 714 Vendor URL: SAP Bug: XSS Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 08.08.2017 Reference: SAP Security Note 2493099 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS Risk: Medium Impact:...

WordPress EELV Newsletter 4.5 XSS / CSRF Vulnerabilities

Exploit for php platform in category web applications Document Title: =============== Wordpress EELV Newsletter v4.5 - Multiple Vulnerabilities Product & Service Introduction: =============================== Add a registration form on FrontOffice, a newsletter manager on backoffice manage skins,...

WordPress EELV Newsletter 4.5 XSS / CSRF

Document Title: =============== Wordpress EELV Newsletter v4.5 - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2069 Release Date: ============= 2017-05-15 Vulnerability Laboratory ID VL-ID: ====================================...

XSS in CRM (Java)

Application: SAP CRM Versions Affected: SAP CRM 700-732 Vendor URL: SAP Bug: XSS Reported: 16.05.2017 Vendor response: 17.05.2017 Date of Public Advisory: 08.08.2017 Reference: SAP Security Note 2481262 Author: Vladimir Egorov ERPScan VULNERABILITY INFORMATION Class: XSS Risk: Medium Impact:...

Session Hijacking, Cookie-Stealing WordPress Malware Spotted

Researchers have identified a strain of cookie stealing malware injected into a legitimate JavaScript file, that masquerades as a WordPress core domain. Cesar Anjos, a security analyst at Sucuri, a firm that specializes in WordPress security, came across the malware during an incident response...