PT-2014-6057

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description A session fixation issue allows remote attackers to hijack web sessions via a firewall login cookie. Recommendations For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue...

Session fixation

Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...

VLC Media Player DLL Hijacking Exploit (wintab32.dll)

No description provided by source. Exploit Title: VLC Player DLL Hijack Vulnerability Date: 25 Aug 2010 Author: Secfence Version: VLC Tested on: Windows XP Place a .mp3 file and wintab32.dll in same folder and execute .mp3 file in vlc player. Code for wintab32.dll: /----------/ / wintab32.cpp /...

CuteNews 1.4.6 editnews Module doeditnews Action Admin Moderation Bypass

No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...

MaxWebPortal 1.30 Remote Database Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/7837/info A number of vulnerabilities have been discovered in the MaxWebPortal. The issues that have been discovered include: MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An...

Microsoft Internet Explorer 5.0.1 Popup.show Mouse Event Hijacking Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10690/info A vulnerability exists in Microsoft Internet Explorer that may permit a malicious Web page to hijack mouse events. This could potentially be exploited to trick an unsuspecting user into performing unintended...

WvTFTPd 0.9 - Remote Root Heap Overflow Exploit

No description provided by source. / wvtftp option name heap overflow remote root exploit infamous42md AT hotpop DOT com exploitation is not exactly straight forward. When we overflow our buffer, we overwrite a pointer that is freed before we get to trigger our overwrite. so we have to restore th...

xt:Commerce 3.04 advanced_search_result.php keywords Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a session of ...

xt:Commerce 3.04 XTCsid Parameter Session Fixation

No description provided by source. source: http://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a session of ...

Fire Soft Board <= 2.0.1 Persistent XSS Vulnerability (admin panel)

No description provided by source. Exploit Title: Fire Soft Board = 2.0.1 Persistent XSS Vulnerability admin panel Date: 2011-07-11 Author: jill for A-S Software Link: http://www.fire-soft-board.com/index.php?p=download&mode=cat&id=2 Version: 2.0.1 There is a vulnerability on Fire Soft Board foru...

RadAsm <= 2.2.1.5 (.RAP File) WindowCallProcA Pointer Hijack Exploit

No description provided by source. !/usr/bin/perl RadAsm =2.2.1.5 WindowCallProcA Pointer Hijack Exploit Tested on Windows XP SP2 FR,perhaps work as will underWindows XP SP3. Long buffer passed to the program by Group key in the project file .rap files can lead to Overwrite the pointer of...

MyGuestbook 1.0 Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4651/info MyGuestbook is freely available guestbook software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. MyGuestbook does not adequately filter script code from various...

PT-2014-4747

Name of the Vulnerable Software and Affected Versions EMC Network Configuration Manager versions prior to 9.3 Description The issue concerns a session fixation vulnerability in the Report Advisor component. This allows remote attackers to hijack web sessions via a session cookie. Recommendations...

OCS Inventory NG 2.0.1 Persistent XSS

No description provided by source. OCS Inventory NG 2.0.1 - Persistent XSS CVE-2011-4024 ------------------------------------------------------- Software : Open Computer and Software OCS Inventory NG Download : http://www.ocsinventory-ng.org/ Discovered by : Nicolas DEROUET nicolas.derouetgmailco...

Elxis CMS 2008.1 modules/mod_language.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31764/info Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation...

Quick Paypal Payments 3.0 - Presistant XSS (0day)

No description provided by source. TITLE ===== Quick Paypal Payments - Persistent Cross Site Scripting Vulnerability AUTHOR ====== Zy0d0x BLOG ==== https://zy0d0x.com DATE ==== 10/08/2013 VENDOR ====== Quick Plugins - http://quick-plugins.com/ AFFECTED PRODUCT ================ Quick Paypal Paymen...

Lunar CMS 3.3 - CSRF And Stored XSS Vulnerability

No description provided by source. ?!-- Lunar CMS 3.3 CSRF And Stored XSS Vulnerability Vendor: Lunar CMS Product web page: http://www.lunarcms.com Affected version: 3.3 Summary: Lunar CMS is a freely distributable open sourcecontent management system written for use on servers running the ever s...

Eric Allman Sendmail 8.8 .x Socket Hijack Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/774/info Through exploiting a combination of seemingly low-risk vulnerabilities in sendmail, it is possible for a malicious local user to have an arbitrary program inherit or hijack the file descriptor for the socket...

CVE-2014-2509: Undefined Security Weakness

Session fixation vulnerability in the Report Advisor RA component in EMC Network Configuration Manager NCM before 9.3 allows remote attackers to hijack web sessions via a session cookie...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Intercom Web Kyukincho 3.x before 3.0.030 allows remote attackers to hijack the authentication of arbitrary users...