CVE-2013-4213

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

Design/Logic Flaw

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4213

Red Hat JBoss EAP 6.1.0 is affected by CVE-2013-4213. The issue is a caching flaw in the EJB client API that prevents proper caching of EJB invocations on the server, allowing remote attackers to hijack user sessions by leveraging an EJB client. This is tied to the Red Hat advisory RHSA-2013:1152...

CVE-2013-4128

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

ejb-client: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

remote-naming: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

remote-naming: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

Joomla! Jomres组件'property_name'参数HTML注入漏洞

Bugtraq ID:61634 CVE ID:CVE-2013-3931 Joomla!是一套在国外相当知名的内容管理系统 当编辑属性细节时，通过"propertyname" POST参数传递的输入在用使用之前缺少过滤，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时可获取敏感信息或者劫持用户会话 0 Jomres 7.3.0 component for Joomla! 厂商解决方案 Jomres 7.3.1 component for Joomla!已经修复此漏洞，建议用户下载更新： http://www.jomres.net/...

Mozilla多个产品不正确XMLHttpRequest调用限制漏洞

CVE ID:CVE-2013-1714 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端 Mozilla Firefox/SeaMonkey/Thunderbird Web Workers实现不正确限制XMLHttpRequest调用，允许远程攻击者利用漏洞绕过同源策略，进行跨站脚本攻击，可获取敏感信息或劫持用户会话 0 Mozilla Firefox 23.0 Mozilla Firefox ESR 17.x Mozilla Thunderbird 17.0.8 Mozilla Thunderbi...

Adobe ColdFusion RDS Authentication Bypass

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to th...

PT-2013-84: Insuffient Entropy in Siemens SIMATIC S7-1500 CPU PLC

The specialists of the Positive Research center have detected an Insuffient Entropy vulnerability in Siemens SIMATIC S7-1500 CPU PLC. Due to low entropy in its random number generator, the authentication of the integrated web server port 80/tcp and port 443/tcp of S7-1500 PLCs might allow attacke...

PT-2013-87: Insuffient Entropy in Siemens SIMATIC S7-1200 CPU PLC

The specialists of the Positive Research center have detected an Insuffient Entropy vulnerability in Siemens SIMATIC S7-1200 CPU PLC. Due to low entropy in its random number generator, the integrated web server’s authentication method port 80/tcp and port 443/tcp could allow attackers to hijack w...

CVE-2013-2994

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 are affected by a vulnerability where a valid session is not properly controlled after unspecified interaction with REST services. This could allow a remote attacker to issue REST requests in the context of an arbitrary user’s active se...

Plone - in_portal.py 4.1.3 Session Hijacking

Plone - inportal.py 4.1.3 Session Hijacking source: https://www.securityfocus.com/bid/61964/info Plone is prone to a session-hijacking vulnerability. An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application. Note: This issue was previousl...

Plone - 'in_portal.py' < 4.1.3 Session Hijacking

source: https://www.securityfocus.com/bid/61964/info Plone is prone to a session-hijacking vulnerability. An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application. Note: This issue was previously discussed in the BID 61544 Plone Multiple...

Download Lite v4.3 iOS - Persistent File Web Vulnerability

Title: ====== Download Lite v4.3 iOS - Persistent File Web Vulnerability Date: ===== 2013-07-19 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1023 VL-ID: ===== 1023 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ===========...

Private Photos 1.0 iOS - Persistent Cross-Site Scripting

Title: ====== Private Photos v1.0 iOS - Persistent Path Web Vulnerability Date: ===== 2013-07-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1034 VL-ID: ===== 1034 Common Vulnerability Scoring System: ==================================== 3.5 Introduction:...

iPic Sharp v1.2.1 Wifi iOS - Persistent Foldername Web Vulnerability

Title: ====== iPic Sharp v1.2.1 Wifi iOS - Persistent Foldername Web Vulnerability Date: ===== 2013-07-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1031 VL-ID: ===== 1031 Common Vulnerability Scoring System: ==================================== 3.6 Introduction:...

SEC Consult SA-20130726-0 :: Multiple vulnerabilities - Surveillance via Symantec Web Gateway

SEC Consult Vulnerability Lab Security Advisory 20130726-0 ======================================================================= title: Multiple vulnerabilities - Surveillance via Symantec Web Gateway product: Symantec Web Gateway vulnerable version: = 5.1.0. fixed version: 5.1.1 CVE number:...

Microsoft EPD - CS Flash Cross Site Web Vulnerability

Document Title: =============== Microsoft EPD - CS Flash Cross Site Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1013 Microsoft Security Response Center MSRC ID: 15156 Release Date: ============= 2013-07-28 Vulnerability Laboratory I...