IBM BlueMix Cloud - (API) Persistent Web Vulnerability

Document Title: =============== IBM BlueMix Cloud - API Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1846 IBM Security Tracking ID: 5377-12593283 Release Date: ============= 2016-07-04 Vulnerability Laboratory ID VL-ID:...

IBM BlueMix Cloud - (API) Persistent Web Vulnerability

Document Title: =============== IBM BlueMix Cloud - API Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1846 IBM Security Tracking ID: 5377-12593283 Release Date: ============= 2016-07-03 Vulnerability Laboratory ID VL-ID:...

CVE-2016-3653

Multiple cross-site request forgery CSRF vulnerabilities in management scripts in Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users...

CVE-2016-4309

Session fixation vulnerability in Symphony CMS 2.6.7, when session.useonlycookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter...

Magento Bug Bounty #18 - Persistent Web Vulnerability

Document Title: =============== Magento Bug Bounty 18 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1464 Magento Security ID: APPSEC-1051 Release Date: ============= 2016-06-30 Vulnerability Laboratory ID VL-ID:...

MediaWiki 1.23.x < 1.23.14 / 1.25.x < 1.25.6 / 1.26.x < 1.26.3 Multiple Vulnerabilities

According to its version number, the MediaWiki application running on the remote web server is 1.23.x prior to 1.23.14, 1.25.x prior to 1.25.6, or 1.26.x prior to 1.26.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists due to a failure to invalidate tokens from...

FantasyTote: Session doesn't expired after login

Hi, I don't know is it a valid vulnerability under your program but I found it. Attacker can use victims cookie to logged in user account again. Steps ===== 1 Login as user 2 Copy cookie you may use http://www.editthiscookie.com addon to edit cookies. 3 Logged out and delete cookie. 4 Now as a...

WordPress <= 4.5.2 - Session Hijacking

This vulnerability allows an attacker to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php. Solution Update WordPress...

Mapbox (API) - Filter Bypass & Persistent Vulnerability

Document Title: =============== Mapbox API - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1787 ID: 119802 Release Date: ============= 2016-06-06 Vulnerability Laboratory ID VL-ID:...

Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability

Document Title: =============== Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1852 Release Date: ============= 2016-05-25 Vulnerability Laboratory ID VL-ID: ==================================== 18...

Infobae Cross Site Scripting

ADVISORY INFORMATION =================== Title: Multiple Reflected XSS vulnerabilities in Infobae Website Date published: 2016-20-05 Vendors contacted: No answer received Vendors website: http://www.infobae.com/ Discovered by: Joel Noguera Independent Security Researcher Severity: Medium AFFECTED...

Apache Tomcat 7.0.x < 7.0.67 / 8.0.x < 8.0.32 Session Hijacking

Binary data 9314.prm...

WordPress Collne Welcart e-Commerce Plugin <= 1.8.2 - Session Hijacking

The Collne Welcart e-Commerce plugin allows an attacker to obtain access by leveraging knowledge of the e-mail address associated with an account. Solution Update the plugin...

Peplink InControl 2 CDM - (API) Persistent Vulnerability

Document Title: =============== Peplink InControl 2 CDM - API Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1841 Release Date: ============= 2016-05-17 Vulnerability Laboratory ID VL-ID: ==================================== 184...

New Relic: New Relic - Session Hijacking

Hey, I have found a vulnerability in New Relic, so the bug is called "Session Hijacking". You can see the Proof of Concept video which I've attached to confirm the vulnerability. Steps to Reproduce: 1 Login to your account 2 Copy your cookies 3 Logout 4 Clear browser cookies 5 Paste the cookies...

Trend Micro Email Spoofing

Document Title: =============== Trend Micro Account - Email Spoofing Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1693 Trend Micro ID: 1-1-1035655030 Release Date: ============= 2016-04-25 Vulnerability Laboratory ID VL-ID:...

VMware vCloud Director 5.5.x < 5.5.6 Client Integration Plugin Session Hijacking (VMSA-2016-0004)

The version of VMware vCloud Director installed on the remote host is 5.5.x prior to 5.5.6. It is, therefore, affected by a flaw in the VMware Client Integration Plugin due to a failure to handle session content in a secure manner. A remote attacker can exploit this, by convincing a user to visit...

VMware vCenter Server 5.5.x < 5.5u3d / 6.0.x < 6.0u2 Client Integration Plugin Session Hijacking (VMSA-2016-0004)

The version of VMware vCenter Server installed on the remote host is 5.5.x prior to 5.5u3d or 6.0.x prior to 6.0u2. It is, therefore, affected by a flaw in the VMware Client Integration Plugin due to a failure to handle session content in a secure manner. A remote attacker can exploit this, by...

C/C++ Offline Compiler and C For OS - Persistent Cross-Site Scripting

Document Title: =============== C & C++ for OS - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1825 Release Date: ============= 2016-04-14 Vulnerability Laboratory ID VL-ID: ====================================...

New Relic: Stored Cross-Site Scripting via Angular Template Injection

It's possible to inject angular expressions into the account settings of a new relic account. This, combined with an angular sandbox escape allows for persistant cross-site scripting which is executed in the browser of any user visiting the affected page. The execution of which could be used to...