LSE Leading Security Experts GmbH - LSE-2014-05-22 - F*EX - Multiple Issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 === LSE Leading Security Experts GmbH - Security Advisory 2014-05-22 === FEX Frams' Fast File EXchange - Multiple Issues - - --------------------------------------------------------------------- Affected Versions ================= FEX Frams' Fast File...

F*EX 20140313-1 HTTP Response Splitting / Cross Site Scripting

FEX version 20140313-1 suffers from HTTP response splitting and cross site scripting vulnerabilities. FEX Frams' Fast File EXchange - Multiple Issues - - --------------------------------------------------------------------- Affected Versions ================= FEX Frams' Fast File EXchange...

CVE-2014-3944

The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors...

CVE-2014-3944

The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors...

CVE-2014-3944

The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors...

C2FO: All Active user sessions should be destroyed when user change his password!

Hello, There is an user sessions issue on your application that should be fixed. Proof of Concept ------------------------ Suppose, you have an account on C2FO app.c2fo.com. Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromise...

HackerOne: All Active user sessions should be deleted when user change his password!

When a user changed his/her password either directly or with reset password flow, existing sessions were kept active. We already invalidate all sessions when a user logs out, but we were not doing the same for password changes. This means that if an attacker were to get access to an account, even...

PT-2014-2528

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions 2.5.x through 2.6.1 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors,...

Heartbleed User Session Extraction Exploit

This python script is a modification of the heartbleed proof of concept exploit that looks for cookies, specifically user sessions. !/usr/bin/python Connects to servers vulnerable to CVE-2014-0160 and looks for cookies, specifically user sessions. Michael Davis email protected Based almost entire...

Heartbleed User Session Extraction

!/usr/bin/python Connects to servers vulnerable to CVE-2014-0160 and looks for cookies, specifically user sessions. Michael Davis [email protected] Based almost entirely on the quick and dirty demonstration of CVE-2014-0160 by Jared Stafford [email protected] The author disclaims...

Google Encrypts All Gmail Connections

Perhaps no company has been as vocal with its feelings about the revelations about the NSA’s collection methods as Google has, and the company has been making a series of changes to its infrastructure in recent months to make it more difficult for adversaries to snoop on users’ sessions. The...

IBM Operational Decision Manager跨站脚本和跨站请求伪造漏洞

Bugtraq ID:66186 IBM Operational Decision Manager是一个运营决策管理平台。 IBM Operational Decision Manager存在跨站脚本和跨站请求伪造攻击，允许攻击者利用漏洞获取敏感信息，劫持用户会话或执行恶意操作。 0 IBM Operational Decision Manager 7.5.0.3 IBM Operational Decision Manager 7.5.0.4 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞：...

Serena Dimensions CM跨站脚本漏洞

Bugtraq ID:65976 CVE ID:CVE-2014-0335 Serena Dimensions CM是一款项目计划管理工具。 Serena Dimensions CM存在多个跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Serena Dimensions CM 12.2 Build 7.199.0 web client 目前没有详细解决方案提供： http://www.serena.com/index.php/en/products/featured-products/dimensions-cm/...

Byte CMS Cross Site Scripting

Exploit Title: Byte CMS Cross Site Scripting Vulnerabilities Date: 02/03/2014 Exploit Author: projectzero labs Projectzero ID: projectzero2014-003-bytecmsxss Vendor Homepage: http://www.bitsnbytes.gr Software Link: N/A - Commercial Tested on: Kali Linux / Iceweasel v.22 & Mac OS X 10.8.5 / Firefo...

POSH多个安全漏洞

Bugtraq ID:65818 POSH是一个基于PHP的WEB应用。 POSH存在多个安全漏洞，包括多个跨站脚本，任意URL重定向和设计漏洞，允许攻击者利用漏洞获取敏感信息或劫持用户会话，及获取用户名和密码MD5摘要信息。 0 POSH = 3.2.1 目前没有详细解决方案提供： http://sourceforge.net/projects/posh/...

FlashCanvas 'proxy.php'跨站脚本漏洞

Bugtraq ID:64251 CVE ID:CVE-2013-6880 FlashCanvas是一个JavaScript库，可使Internet Explorer支持HTML5 Canvas。 FlashCanvas 'proxy.php'脚本不充分校验Referer Header数据，允许远程攻击者利用漏洞提交特制的GET请求，可获取敏感信息或劫持用户会话。 0 FlashCanvas 1.5 厂商补丁： FlashCanvas ----- FlashCanvas 1.6已经修复该漏洞，请到厂商的主页下载： http://flashcanvas.net/...

PT-2013-5047

Name of the Vulnerable Software and Affected Versions CollectiveAccess Providence and Pawtucket versions prior to 1.3.1 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via...

PT-2013-5231

Name of the Vulnerable Software and Affected Versions HP Service Manager versions 9.30 through 9.32 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This could potentially lead to unauthorized access or control of...

Plone - in_portal.py 4.1.3 Session Hijacking

Plone - inportal.py 4.1.3 Session Hijacking source: https://www.securityfocus.com/bid/61964/info Plone is prone to a session-hijacking vulnerability. An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application. Note: This issue was previousl...

Resin Application Server 4.0.36 Cross Site Scripting

Resin Application Server 4.0.36 Cross-Site Scripting Vulnerabilities Vendor: Caucho Technology, Inc. Product web page: http://www.caucho.com Affected version: Resin Professional Web And Application Server 4.0.36 Summary: Resin is the Java Application Server for high traffic sites that require...