Red Hat Conga

CPE Details

Red Hat Conga
redhat
conga
-
2007-11-14
16h37 +00:00
2007-11-14
16h37 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:redhat:conga:-:*:*:*:*:*:*:*

Informations

Vendor

redhat

Product

conga

Version

-

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2012-3359 2014-03-29 23h00 +00:00 Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
3.7
CVE-2013-7347 2014-03-29 23h00 +00:00 Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
3.7
CVE-2011-0720 2011-02-03 15h00 +00:00 Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
7.5
CVE-2010-3852 2010-11-05 21h00 +00:00 The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.
6.4