6615 matches found
Jease CMS 2.11 Script Insertion
Document Title: =============== Jease CMS v2.11 - Persistent UI Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1373 Release Date: ============= 2014-12-12 Vulnerability Laboratory ID VL-ID: ==================================== 1373...
Oracle database vulnerability analysis: the need for a username and password to access your database-vulnerability warning-the black bar safety net
Summary General database vulnerabilities that are in a successful connection or login to the database after the invasion; this article describes two in 2 0 1 2 years of exposure to the Oracle, by these two vulnerabilities combined may not grasp the username/password of the case of the invasion of...
CVE-2014-9386
Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...
Cross site scripting
Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...
CVE-2014-9386
CVE-2014-9386 affects Zenoss Core before 4.2.5 SP161. The issue is an infinite lifetime for the session ID cookie, enabling potential session hijacking by an attacker with access to an unattended workstation. The CVE description notes the root cause is the cookie’s unlimited lifetime, which can l...
Session fixation
Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privileges via a brute force session hijacking attack...
CVE-2014-8496
Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privileges via a brute force session hijacking attack...
CVE-2014-8496
Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privileges via a brute force session hijacking attack...
Drupal Session Hijacking Vulnerability
Drupal is vulnerable to session hijacking. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Code injection
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors...
CVE-2014-4831
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors...
CVE-2014-4831
CVE-2014-4831 affects IBM QRadar products: QRadar SIEM 7.1 MR2 (patch 9) and 7.2 (patch 1 for 7.2.4) as well as QRadar Vulnerability Manager 7.2 prior to 7.2.4 Patch 1, and QRadar Risk Manager in related builds. Root cause: improper validation allowing remote attackers to hijack a valid user’s se...
AIX Java Advisory : java_oct2014_advisory.asc (POODLE)
The version of Java SDK installed on the remote host is affected by the following vulnerabilities : - A privilege escalation vulnerability in the IBM Java SDK allows a local attacker to inject arbitrary code into the shared classes cache due to a flaw in the default configuration for the shared...
Updated drupal packages fix security vulnerabilities
Updated drupal packages fix security vulnerability: Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session CVE-2014-9015. Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the...
MGASA-2014-0492 Updated drupal packages fix security vulnerabilities
Updated drupal packages fix security vulnerability: Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session CVE-2014-9015. Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the...
Extremely dangerous and common web site security vulnerabilities-a vulnerability warning-the black bar safety net
Recently dealt with a company outside the network project of the two security vulnerabilities are very common, and very dangerous. A reflected cross site scripting vulnerability Vulnerability risk: Can be embedded in the attack script, once in the user's browser to load the page, it will execute...
UBUNTU-CVE-2014-9015
Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...
CVE-2014-9015
Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...
CVE-2014-9015
CVE-2014-9015 affects Drupal 6.x before 6.34 and Drupal 7.x before 7.34. A crafted request (to a server handling both HTTP and HTTPS) can hijack an active user session. The vulnerability stems from how sessions are managed in these versions, enabling an attacker to take over another user’s sessio...
