Microsoft Internet Information Server (IIS) vulnerable to cross-site scripting via HTTP TRACK method

Overview Microsoft Internet Information Server IIS servers support a HTTP method called TRACK. The HTTP TRACK method returns the contents of client HTTP requests in the entity-body of the TRACK response. This behavior could be leveraged by attackers to access sensitive information, such as cookie...

CVE-2003-1249

WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions...

CVE-2003-1230

The implementation of SYN cookies syncookies in FreeBSD 4.5 through 5.0-RELEASE-p3 uses only 32-bit internal keys when generating syncookies, which makes it easier for remote attackers to conduct brute force ISN guessing attacks and spoof legitimate traffic...

CVE-2003-1504

SQL injection vulnerability in variables.php in Goldlink 3.0 allows remote attackers to execute arbitrary SQL commands via the 1 vadminlogin or 2 vadminpass cookie in a request to goldlink.php...

CVE-2003-1238

Cross-site scripting vulnerability XSS in Nuked-Klan 1.3 beta and earlier allows remote attackers to steal authentication information via cookies by injecting arbitrary HTML or script into op of the 1 Team, 2 News, and 3 Liens modules...

Important: Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes

Updated XFree86 packages for Red Hat Linux 9 provide security fixes to font libraries and XDM. XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers in Red Hat Linux. XDM is the X display manager. Multiple integer overflows in the transf...

Corsaire Security Advisory: PeopleSoft IScript XSS issue

-- Corsaire Security Advisory -- Title: PeopleSoft IScript XSS issue Date: 04.07.03 Application: PeopleTools 8.20/8.43 and prior Environment: Various Author: Glyn Geoghegan [email protected] Audience: General distribution Reference: c030704-004 -- Scope -- The aim of this document is to...

[Full-Disclosure] Corsaire Security Advisory: BEA WebLogic example InteractiveQuery.jsp XSS issue

-- Corsaire Security Advisory -- Title: BEA WebLogic example InteractiveQuery.jsp XSS issue Date: 04.07.03 Application: BEA WebLogic 8.1 and prior Environment: Various Author: Martin O'Neal [email protected] Audience: General distribution Reference: c030704-008 -- Scope -- The aim of this...

Chi Kien Uong Guestbook 1.51 - Cross-Site Scripting

Chi Kien Uong Guestbook 1.51 - Cross-Site Scripting source: https://www.securityfocus.com/bid/8896/info It has been reported that Chi Kien Uong Guestbook may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The...

Re: Internet Explorer and Opera local zone restriction bypass

There was not a lot of details in your post, so I will try to verify and clarify your findings. First things first, this is not a problem with Microsofts Internet Explorer, but with Macromedia and their Flash player. I could reproduce this issue successfully with a fresh install of the latest Fla...

Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location

source: https://www.securityfocus.com/bid/8900/info Macromedia Flash Player is reported to store Flash cookies .sol files in a predictable location on client systems. Other attacks are possible given the ability to store content on a system in a predictable location, such as referencing the conte...

Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location

Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location source: https://www.securityfocus.com/bid/8900/info Macromedia Flash Player is reported to store Flash cookies .sol files in a predictable location on client systems. Other attacks are possible given the ability to store conte...

[SECURITY] [DSA-388-1] New kdebase packages fix multiple vulnerabilites in KDM

-------------------------------------------------------------------------- Debian Security Advisory DSA 388-1 [email protected] http://www.debian.org/security/ Matt Zimmerman September 19th, 2003 http://www.debian.org/security/faq -...

CVE-2003-0801

CVE-2003-0801 – Nokia Electronic Documentation (NED) 5.0 suffers a cross-site scripting (XSS) vulnerability. A remote attacker can cause the application to execute arbitrary web script and steal cookies via a crafted URL to the docs/ directory containing the script. Public references indicate an ...

CVE-2003-0801

Cross-site scripting XSS vulnerability in Nokia Electronic Documentation NED 5.0 allows remote attackers to execute arbitrary web script and steal cookies via a URL to the docs/ directory that contains the script...

[KDE SECURITY ADVISORY] KDM vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: KDM vulnerabilities Original Release Date: 2003-09-16 URL: http://www.kde.org/info/security/advisory-20030916-1.txt 0. References http://cert.uni-stuttgart.de/archive/suse/security/2002/12/ msg00101.html...

Weak KDM session cookie generation in KDE

Weak cookies during authentication allow session hijacking...

PostNuke 0.60.7 web_links Module - TTitle Cross-Site Scripting

PostNuke 0.60.7 weblinks Module - TTitle Cross-Site Scripting source: https://www.securityfocus.com/bid/8374/info It has been reported that a cross site scripting vulnerability exists in the Downlaods and WebLinks modules of PostNuke. It is possible that an attacker may construct a link containin...

Weaknesses in MIT magic cookie and XDM X Windows authorization

Overview MIT magic cookie and XDM authorization contain vulnerabilities that could allow remote attackers to connect to X displays. Description Two widely used X Window System authorization schemes have weaknesses in their sample implementations. MIT-MAGIC-COOKIE-1 On some systems built without t...

XSS Vulnerability in LedNews (CGI/Perl) v0.7

XSS Vulnerability in LedNews CGI/Perl v0.7 URL: http://www.ledscripts.com/index.php?page=free:perl:lednews Description ======= LedNews is a CGI application written entirely in perl. Its designed to be as simple as possible, but very powerful at the same thing. Vulnerability ======== The script do...