CVE-2008-3760

The CVE-2008-3760 entry documents a CSRF flaw in Vanilla CMS prior to and including version 1.1.4, located on the sign-out page. The vulnerability lets remote attackers hijack a user’s authenticated session by triggering a logout via a SignOutNow request to people.php, with no user interaction re...

flexcms-xss.txt

---------------------------------------------------------------- Script : FlexCMS alertdocument.cookie Attacker can hijack admin cookie with this vulnerability .... Solution for patch : filter PreviousColorsString variable with htmlspecialchars function...

Session fixation

Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the sessionid parameter to match the victim's nickid parameter...

CVE-2008-3428

Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the sessionid parameter to match the victim's nickid parameter...

CVE-2008-3421

Multiple cross-site request forgery CSRF vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to 1 updatemodule.jsp, 2 enrollcourse.pl, and 3...

OpenSSH 'X11UseLocalhost' X11转发会话劫持漏洞

BUGTRAQ ID: 30339 CNCAN ID：CNCAN-2008072308 OpenSSH是一种开放源码的SSH协议的实现。 部分操作系统下的OpenSSH存在安全问题，本地攻击者可以利用漏洞劫持转发X连接。 当尝试bind2到之前已经使用SOREUSEADDR设置绑定的端口，多数操作系统会检查是否有效user-id匹配之前的绑定一般BSD衍生系统或绑定地址没有交迭Linux和Solaris。...

CVE-2008-3259

OpenSSH before 5.1 sets the SOREUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform...

CVE-2008-3259

OpenSSH before 5.1 sets the SOREUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform...

CVE-2008-3259

OpenSSH before 5.1 sets the SOREUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform...

CVE-2008-3259

OpenSSH vulnerability CVE-2008-3259 affects OpenSSH before 5.1. On affected platforms, when X11UseLocalhost is disabled, SSHD sets SO_REUSEADDR which can allow local users to hijack the X11 forwarding port by binding to a single IP address (demonstrated on HP-UX). The provided description notes t...

CVE-2008-3259

OpenSSH before 5.1 sets the SOREUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform...

PT-2008-4675 · Openssh +1 · Openssh +1

Name of the Vulnerable Software and Affected Versions: OpenSSH versions prior to 5.1 Description: The issue allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address when the X11UseLocalhost configuration setting is disabled. This has been demonstrat...

Cross site scripting

Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this issue may exist becaus...

CVE-2008-3172

Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...

CVE-2008-3172

Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...

Multiple vulnerabilities in Webmin and Usermin

Overview Webmin and Usermin, web-based system management tools, contain the following vulnerabilities: - Execution of arbitrary files and viewing source code by bypassing Webmin and Usermin's access restrictions - Cross-site scripting We are aware that these vulnerabilities have been addressed in...

Movable Type cross-site scripting vulnerability

Overview Movable Type, a web log system from Six Apart, contains a cross-site scripting vulnerability. This vulnerability is different from JVN68295640. Impact An arbitrary script could be executed on the user's web browser or the display of a web page could be falsified. In addition, an attacker...

Cybozu Office browser script execution vulnerability

Overview The HTML-mail compliant web mail function of Cybozu Office contains a vulnerability that may allow an attacker to execute browser script. Impact If a Cybozu Office user logs into the system and opens an email containing exploit code sent by a remote attacker using the web mail function,...

Apache Tomcat fails to properly handle cookie value

Overview Apache Tomcat from the Apache Software Foundation contains a vulnerability that could allow a remote attacker to coerce a crafted cookie to a user's web browser. Apache Tomcat from the Apache Software Foundation is a web container that implements both Java Servlets and JavaServer Pages...

GLSA-200805-03 : Multiple X11 terminals: Local privilege escalation

The remote host is affected by the vulnerability described in GLSA-200805-03 Multiple X11 terminals: Local privilege escalation Bernhard R. Link discovered that RXVT opens a terminal on :0 if the '-display' option is not specified and the DISPLAY environment variable is not set. Further research ...