CVE-2015-2029

Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier...

Session fixation

Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier...

CVE-2015-2029

IBM WebSphere eXtreme Scale 7.1.0 (before 7.1.0.3) and 7.1.1 (before 7.1.1.1) expose a session fixation vulnerability that allows remote attackers to hijack a user’s web session by exploiting an existing session identifier. The issue stems from improper session management (failure to invalidate o...

CVE-2015-2029

Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier...

smb-vuln-regsvc-dos NSE Script

Checks if a Microsoft Windows 2000 system is vulnerable to a crash in regsvc caused by a null pointer dereference. This check will crash the service if it is vulnerable and requires a guest account or higher to work. The vulnerability was discovered by Ron Bowes while working on smb-enum-sessions...

Imgur: "Sign me out everywhere" does not work for desktop sessions

An account option that allowed users to sign out everywhere was found to not be functioning properly. A user selecting this option was not signed out. A fix has been rolled out to update session security as a result of this report...

Group Policy Management Template Updates for XenApp/XenDesktop

This page contains links to download additional templates and updates to the Citrix templates built-in to XenApp and XenDesktop Group policy management package. Background While you still find Citrix provided templates in Citrix Studio and in a GPO editor after installing the Group Policy...

IBM WebSphere eXtreme Scale Access Privilege Bypass Vulnerability

IBM WebSphere eXtreme Scale is a distributed caching solution. IBM WebSphere Extreme Scale does not invalidate pre-existing session identifiers, allowing remote attackers to exploit the vulnerability to gain access to other users...

Winmail Server 'badlogin.php' Cross-Site Scripting Vulnerability

Winmail Server is a set of mail server software. A cross-site scripting vulnerability exists in Winmail Server badlogin.php, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...

Apache Struts Cross-Site Scripting Vulnerability

Apache Struts is an open source framework for creating enterprise Java Web applications. Apache Struts suffers from a cross-site scripting vulnerability when the JSP is directly accessible, allowing remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be...

IBM OpenPages GRC Platform Cross-Site Scripting Vulnerability

IBM OpenPages GRC Platform is a suite of governance, risk and compliance platforms for managing enterprise risk and compliance challenges. A cross-site scripting vulnerability exists in IBM OpenPages GRC Platform, which allows remote attackers to exploit the vulnerability to inject malicious scri...

Kirby CMS 2.1.0 - Authentication Bypass

============================================= - Release date: 14.09.2015 - Discovered by: Dawid Golunski - Severity: Medium/High ============================================= I. VULNERABILITY ------------------------- Kirby CMS = 2.1.0 Authentication Bypass via Path Traversal II. BACKGROUND...

The vulnerability of the Django web application framework, which allows a hacker to trigger a denial-of-service attack

The vulnerability of the contrib.sessions.middleware.SessionMiddleware component in the Django web framework is related to a resource management error. Exploiting this vulnerability allows an attacker to cause service failures by sending a large number of requests to contrib.auth.views.logout,...

python-django: Denial-of-service possibility in logout() view by filling session store

It was found that certain Django functions would, in certain circumstances, create empty sessions. A remote attacker could use this flaw to fill up the session store or cause other users' session records to be evicted by requesting a large number of new sessions...

python-django: Denial-of-service possibility in logout() view by filling session store

It was found that certain Django functions would, in certain circumstances, create empty sessions. A remote attacker could use this flaw to fill up the session store or cause other users' session records to be evicted by requesting a large number of new sessions...

The vulnerability of iOS and Mac OS X operating systems allows attackers to gain access to the MAC addresses of devices, which are obtained during previous Wi-Fi sessions.

The vulnerability of the bootp component in iOS and Mac OS X operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to access the protected information about the MAC addresses of devices, obtained during previous WiFi sessions,...

DEBIAN-CVE-2015-5963

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service session store consumption or session record removal via a large number of requests to...

Code injection

The 1 contrib.sessions.backends.base.SessionBase.flush and 2 cachedb.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service session stor...

Drupal Autocomplete System Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Autocomplete System, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

Cisco ASR 9000 Series Router vty session closure denial of service vulnerability

The Cisco ASR 9000 is Cisco's ultra-high-capacity, carrier-grade edge router platform designed for next-generation IP network IP NGN transformation. A security vulnerability exists in the Cisco ASR 9000 series routers that allows local users to exploit the vulnerability to shut down VTY sessions ...