CVE-2008-3172

Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...

CVE-2008-3172

Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...

Movable Type cross-site scripting vulnerability

Overview Movable Type, a web log system from Six Apart, contains a cross-site scripting vulnerability. This vulnerability is different from JVN68295640. Impact An arbitrary script could be executed on the user's web browser or the display of a web page could be falsified. In addition, an attacker...

Multiple vulnerabilities in Webmin and Usermin

Overview Webmin and Usermin, web-based system management tools, contain the following vulnerabilities: - Execution of arbitrary files and viewing source code by bypassing Webmin and Usermin's access restrictions - Cross-site scripting We are aware that these vulnerabilities have been addressed in...

Cybozu Office browser script execution vulnerability

Overview The HTML-mail compliant web mail function of Cybozu Office contains a vulnerability that may allow an attacker to execute browser script. Impact If a Cybozu Office user logs into the system and opens an email containing exploit code sent by a remote attacker using the web mail function,...

Apache Tomcat fails to properly handle cookie value

Overview Apache Tomcat from the Apache Software Foundation contains a vulnerability that could allow a remote attacker to coerce a crafted cookie to a user's web browser. Apache Tomcat from the Apache Software Foundation is a web container that implements both Java Servlets and JavaServer Pages...

GLSA-200805-03 : Multiple X11 terminals: Local privilege escalation

The remote host is affected by the vulnerability described in GLSA-200805-03 Multiple X11 terminals: Local privilege escalation Bernhard R. Link discovered that RXVT opens a terminal on :0 if the '-display' option is not specified and the DISPLAY environment variable is not set. Further research ...

Multiple terminal clients X sessions hijack

Terminal always opens :0 display if DISPLAY is not set...

Maian Weblog v4.0 XSS Vulnerabilities

---------------------------------------------------------------- Script : Maian Weblog v4.0 Type : XSS Vulnerabilities ---------------------------------------------------------------- Discovered by : Khashayar Fereidani Or Dr.Crash Our Team : IRCRASH...

ldm / ltsp X session hijack

It's possible to connect to X server of any LTSP client...

Coppermine <=1.4.17 SQL-inj Session Hijack Exploit

Coppermine =1.4.17 SQL-inj Session Hijack Exploit 1 Дата: Пропатчена: April 11, 2008 http://forum.coppermine-gallery.net/index.php/topic,51882.0.html 2 Продукт: Coppermine Photo Gallery =1.4.17 3 Уязвимость: SQL-инъекция в $COOKIE$this-clientid в /bridge/coppermine.inc.php Значение извлекается из...

GLSA-200804-03 : OpenSSH: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-200804-03 OpenSSH: Privilege escalation Two issues have been discovered in OpenSSH: Timo Juhani Lindfors discovered that OpenSSH sets the DISPLAY variable in SSH sessions using X11 forwarding even when it cannot bind the X11 serve...

Design/Logic Flaw

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...

CVE-2008-1692

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...

CVE-2008-1692

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...

DEBIAN-CVE-2008-1692

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...

CVE-2008-1692

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...

CVE-2008-1692

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...

CVE-2008-1692

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...

CVE-2008-1692

CVE-2008-1692 affects several X11 terminal emulators (Eterm 0.9.4; and also aterm, rxvt, rxvt-unicode, wterm, Mrxvt, multi-aterm) used on X displays. The root cause is that Eterm opens a :0 terminal when -display is not provided and DISPLAY is unset, enabling a local attacker to hijack X11 termin...