8108 matches found
CVE-2007-4438
Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors...
Session fixation
Session fixation vulnerability in Joomla! before 1.0.13 aka Sunglow allows remote attackers to hijack administrative web sessions via unspecified vectors...
CVE-2007-4203
Session fixation vulnerability in Mambo 4.6.2 CMS allows remote attackers to hijack web sessions by setting the Cookie parameter...
FreeBSD : joomla -- multiple vulnerabilities (4872d9a7-4128-11dc-bdb0-0016179b2dd5)
A Secunia Advisory reports : joomla can be exploited to conduct session fixation attacks, cross-site scripting attacks or HTTP response splitting attacks. Certain unspecified input passed in comsearch, comcontent and modlogin is not properly sanitised before being returned to a user. This can be...
CVE-2007-3988
CVE-2007-3988 affects Virtual Hosting Control System (VHCS) up to version 2.4.7.1. The issue is a session fixation vulnerability where the web GUI accepts PHPSESSID values from GET/POST, enabling a remote attacker to hijack a user session. Impact is partial confidentiality/integrity/availability ...
CVE-2004-2681
PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a session...
CVE-2004-2681
CVE-2004-2681 affects PeerSec MatrixSSL prior to 1.1. The issue is that session keys are cached for an indefinitely long time, which could allow remote attackers to hijack a session. The supplied documents confirm the vulnerability description but do not provide concrete exploitation details or a...
Microsoft Windows Vista/2003/XP/2000 file management security issues
Title: Microsoft Windows Vista/2003/XP/2000 file management security issues Author: 3APA3A, http://securityvulns.com/ Vendor: Microsoft and potentially another vendors Products: Microsoft Windows Vista/2003/XP/2000, Microsoft resource kit for Windows 2000 and different utilities. Access Vector:...
CVE-2007-3319
The Avaya 4602SW IP Phone Model 4602D02A with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications...
CVE-2007-3319
The Avaya 4602SW IP Phone Model 4602D02A with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications...
CVE-2007-3053
Session fixation vulnerability in Calimero.CMS 3.3.1232 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...
CVE-2007-3050
Session fixation vulnerability in chameleon cms 3.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...
Session fixation
Session fixation vulnerability in Calimero.CMS 3.3.1232 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...
Session fixation
Session fixation vulnerability in HP Systems Insight Manager SIM 4.2 and 5.0 SP4 and SP5 allows remote attackers to hijack web sessions by setting the JSESSIONID cookie...
CVE-2007-2546
Session fixation vulnerability in Simple Machines Forum SMF 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...
CVE-2007-2277
CVE-2007-2277 describes a session-fixation vulnerability in Plogger, where remote attackers can hijack web sessions by setting the PHPSESSID parameter. The vulnerability concerns the PHP session handling in Plogger and can result in partial confidentiality, integrity, and availability impacts as ...
[Full-disclosure] Dotclear 1.* Cross Site Scripting Vulnerability
Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing a remote attackers to hijack authenticated session Workaround: $postid trackback.php $toolurl/tools/thememng/index.php are not filtered 2-Proof of Concepts:...
dotclear-xss.txt
------=Part236063482423.1176380209314 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing ...