https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:38:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-112528 EUVD-2026-112528 https://cve.radiocsirt.org/vuln/euvd-2026-112528 https://cve.radiocsirt.org/vuln/fkie_cve-2012-4529 <p>The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.</p> <p>The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2012-4529 https://cve.radiocsirt.org/vuln/ghsa-jfrq-h23h-p4q6 <p>The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.</p> <p>The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.</p> https://cve.radiocsirt.org/vuln/ghsa-jfrq-h23h-p4q6 https://cve.radiocsirt.org/vuln/gsd-2012-4529 gsd-2012-4529 https://cve.radiocsirt.org/vuln/gsd-2012-4529 https://cve.radiocsirt.org/vuln/rhsa-2013:0833 <p>Web: jsessionid exposed via encoded url when using cookie based session tracking JBoss: custom authorization module implementations shared between applications apache-cxf: XML encryption backwards compatibility attacks openssl: DoS due to improper handling of OCSP response verification SSL/TLS: CBC padding timing attack (lucky-13) Installer: Generated auto-install xml is world readable tomcat: Session fixation in form authenticator</p> <p>Web: jsessionid exposed via encoded url when using cookie based session tracking JBoss: custom authorization module implementations shared between applications apache-cxf: XML encryption backwards compatibility attacks openssl: DoS due to improper handling of OCSP response verification SSL/TLS: CBC padding timing attack (lucky-13) Installer: Generated auto-install xml is world readable tomcat: Session fixation in form authenticator</p> https://cve.radiocsirt.org/vuln/rhsa-2013:0833