EUVD-2010-1872

Microsoft Internet Explorer, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site...

CVE-2010-1851

CVE-2010-1851 affects Google Chrome with the Invisible Hand extension enabled. The issue stems from cookies being used during background HTTP requests, which could enable remote servers to correlate requests and identify specific users and their product searches through HTTP request logging, desc...

CVE-2010-1852

CVE-2010-1852 concerns Microsoft Internet Explorer when the Invisible Hand extension runs. The cited data describe that cookies are used during background HTTP requests in an unexpected manner, which could allow remote web servers to identify users and their product searches via HTTP request logg...

Microsoft Office SharePoint Server help.aspx Cross Site Scripting (CVE-2010-0817)

Microsoft Windows SharePoint Services WSS is an add-on component of Windows Server that provides content managament functionality. WSS is based on IIS and ASP.NET technologies, providing a basic portal infrastructure, collaborative editing of documents, document organization, and version control...

A permanent network of personal music box LajoxBox v1. 1 latest upload exploit-vulnerability warning-the black bar safety net

Vulnerability description: 1. The default database download 2. Background verification is not strictly, there upload vulnerability that can be submitted to the asa horse The exploit: the 1. Download default database data/music. asa, will bereplaced with%2 3 to download. 2. http://www. hackqing...

Fixed HTTP Session Cookies

The remote web application uses cookies to track authenticated users. If the session cookie is already present before authentication, it remains unchanged after a successful login. A remote attacker can exploit this to hijack a valid user session. Session cookies are expected to be unpredictable ...

Lotus Domino Web Administrator - XSS

Application: Lotus Domino Versions Affected: Lotus Domino Web Administrator 6.5 and 8.5.1 Vendor URL: IBM Bugs: XSS Exploits: YES Reported: 22.04.2010 Vendor response: 22.04.2010 Date of Public Advisory: 24.03.2013 Reference: IBM CVE number: CVE-2013-0488 Author: Dmitry Chastukhin ERPScan...

Authentication flaw

The administrative web console on the TANDBERG Video Communication Server VCS before X4.3 uses predictable session cookies in 1 tandberg/web/lib/secure.php and 2 tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by...

CVE-2009-4509

The administrative web console on the TANDBERG Video Communication Server VCS before X4.3 uses predictable session cookies in 1 tandberg/web/lib/secure.php and 2 tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by...

CVE-2009-4509

The TANDBERG Video Communication Server (VCS) web management interface in versions around x4.2.1 (and possibly earlier) uses forged/predictable session cookies in tandberg/web/lib/secure.php and tandberg/web/user/lib/secure.php, enabling an unauthenticated attacker to bypass authentication and po...

Changes to Flash Good for Bank Fraud

When the final version of Adobe Flash Player 10.1 hits desktops later this year, it will bring with it new functionality designed to allow users to automatically clear Flash cookies after a Web session. But while the feature may be lauded in the name of privacy, it may also force online banks to...

XSS Vulnerabilities in JIRA

panel:borderColor=ff0000|borderStyle=solid|bgColor=ffccccWarning: This issue is superceded by JRA-21004. Please install the patches on that issue, rather than this one. For more details, see JIRA Security Advisory -...

XSS Vulnerabilities in JIRA

panel:borderColor=ff0000|borderStyle=solid|bgColor=ffccccWarning: This issue is superceded by JRA-21004. Please install the patches on that issue, rather than this one. For more details, see JIRA Security Advisory -...

CVE-2010-1243

The IBM Web Interface for Content Management aka WEBi before 1.0.4 creates persistent cookies on client workstations, which has unspecified impact and attack vectors...

Code injection

The IBM Web Interface for Content Management aka WEBi before 1.0.4 creates persistent cookies on client workstations, which has unspecified impact and attack vectors...

CVE-2010-1243

The IBM Web Interface for Content Management aka WEBi before 1.0.4 creates persistent cookies on client workstations, which has unspecified impact and attack vectors...

Design/Logic Flaw

The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php...

CVE-2010-1136

The CVE-2010-1136 issue affects Tiki Wiki CMS/Groupware 3.x up to, but not including, version 3.5. The vulnerability arises in the Standard Remember (persistent login) mechanism, where cookies are generated in a way that is predictable based on the client IP address and User-Agent in userslib.php...

Design/Logic Flaw

The Linear Congruential Generator LCG in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function...

CVE-2010-1128

The Linear Congruential Generator LCG in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function...