SAP HANA Encryption Vulnerabilities

SAP’s in-memory relational database management system, HANA, contains a whopper of a security weakness: a default encryption key guarding passwords, stored data and backups. Researchers from ERPScan, which recently uncovered serious configuration vulnerabilities in Oracle PeopleSoft products, on...

Cacti Cross-Site Scripting Vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools. Cacti suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

Adobe Connect Cross-Site Scripting Vulnerability

Adobe Connect is an enterprise web conferencing solution. A cross-site scripting vulnerability exists in Adobe Connect, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions whe...

Drupal Webform module cross-site scripting vulnerability (CNVD-2015-03861)

Drupal is a free and open source content management system developed in PHP. webform is a market research questionnaire module. A cross-site scripting vulnerability exists in the Drupal Webform module processing node header, which allows remote attackers to exploit the vulnerability to inject...

Design/Logic Flaw

The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack...

Shopify: Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS

If an owner or an administrator clicks "Expire User Sessions" in Admin Site although you get the notification that all users where logged out, but this does not actually happens for the user that is currently logged in using the Shopify Application in IOS This was tested on the latest Shopify app...

ZOHO NetFlow Analyzer Cross-Site Scripting Vulnerability

ZOHO NetFlow Analyzer is a set of network traffic analysis software. The software provides bandwidth monitoring and flow analysis, network forensics and security analysis. ZOHO NetFlow Analyzer suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the...

Eliacom Enhanced SQL Portal 'iframe.php' Cross-Site Scripting Vulnerability

Eliacom Enhanced SQL Portal is a database management system. A cross-site scripting vulnerability in Eliacom Enhanced SQL Portal allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...

Cisco FireSIGHT System Software Cross-Site Scripting Vulnerability

The Cisco FireSIGHT Management Center centrally manages the network security and operational functions of Cisco ASA and Cisco FirePOWER Network Security Appliances with FirePOWER Services. Multiple cross-site scripting vulnerabilities in the management web interface of the Management Center...

Code injection

Beckwith Electric M-6200 Digital Voltage Regulator Control with firmware before D-0198V04.07.00, M-6200A Digital Voltage Regulator Control with firmware before D-0228V02.01.07, M-2001D Digital Tapchanger Control with firmware before D-0214V01.10.04, M-6283A Three Phase Digital Capacitor Bank...

Vulnerability in Moodle 'message/index.php'

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in the Moodle 'message/index.php' script. Due to the program failing to properly check the...

Fedora 22 : pcs-0.9.139-4.fc22 (2015-8765)

Fix for CVE-2015-1848, CVE-2015-3983 sessions not signed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

Fedora 20 : pcs-0.9.115-3.fc20 (2015-8761)

Fix for CVE-2015-1848, CVE-2015-3983 sessions not signed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

CVE-2014-8391

The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive information from other users' sessions via a large number of requests...

CVE-2014-0999

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header...

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

CVE-2015-2853

CVE-2015-2853 is a session-fixation vulnerability in the WebUI of Blue Coat SSL Visibility Appliance (SV800, SV1800, SV2800, SV3800) affecting versions 3.6.x–3.8.x up to 3.8.4. The root cause is that the session ID is set before authentication and is not invalidated or changed after login, enabli...

CVE-2015-2853

Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID...

SITEFACT '/index.cfm' Cross-Site Scripting Vulnerability

SITEFACT is an open source content management system. SITEFACT '/index.cfm' suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...

Drupal Navigate module cross-site scripting vulnerability

Drupal is a free, open-source content management system developed in the PHP language.Navigate is one of the customizable navigation modules that supports rapid deployment. A cross-site scripting vulnerability exists in the Drupal Navigate module, which allows remote attackers to exploit the...