Debian DSA-1994-1 : ajaxterm - weak session IDs

It was discovered that Ajaxterm, a web-based terminal, generates weak and predictable session IDs, which might be used to hijack a session or cause a denial of service attack on a system that uses Ajaxterm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Debian Security Advisory DSA 1994-1 (ajaxterm)

The remote host is missing an update to ajaxterm announced via advisory DSA 1994-1. OpenVAS Vulnerability Test $Id: deb19941.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 1994-1 ajaxterm Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

[SECURITY] [DSA 1994-1] New ajaxterm packages fix session hijacking

------------------------------------------------------------------------ Debian Security Advisory DSA-1994-1 [email protected] http://www.debian.org/security/ Raphael Geissert February 11, 2010 http://www.debian.org/security/faq -...

DSA-1994-1 ajaxterm - session hijacking

Bulletin has no description...

[CORE-2010-0121] Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers 1. Advisory Information Title: Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Serve...

CVE-2010-0140

Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.02.3 hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create 1 user or 2 administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 a...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.02.3 hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create 1 user or 2 administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 a...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Advisory ID: cisco-sa-20100127-mp Revision 1.0 For Public Release 2010 Jan 27 1600 UTC GMT +--------------------------------------------------------------------- Summary...

CiviCRM 3.1 < Beta 5 - Multiple Cross-Site Scripting Vulnerabilities

Author: h00die [email protected] & Ch3nz [email protected] Software Link: http://sourceforge.net/projects/civicrm/files/civicrm-latest/3.1.beta1/civicrm-3.1.beta1-standalone.tar.gz/download Version: and from being in the same input box. In several cases it is possible to use multiple input boxes th...

On a national content-filtering system Dos security defect analysis-vulnerability warning-the black bar safety net

Author: jianxin 80sec EMail: jianxin80sec.com Site: http://www.80sec.com Date: 2009-1-2 From: http://www.80sec.com/release/dos-with-XXX.txt Directory 0×0 0 Preface 0×0 1 know it, understand this content filtering system 0×0 2 Hack it, the firewall class ids of some security research 0×0 3 somethi...

Twitter, Google Calendar Open to XSS Holes

In a proof of concept, researcher Nir Goldshlager demonstrated cross-site scripting XSS vulnerabilities in Google Calendar and Twitter that he said could be used to steal cookies and session IDs. Read the full article. eWEEK...

Design/Logic Flaw

Directory Proxy Server DPS in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges o...

CVE-2009-4440

Directory Proxy Server DPS in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges o...

CVE-2009-4440

Directory Proxy Server DPS in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges o...

CVE-2009-4440

Sun Java System Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition, versions 6.0–6.3.1 (Windows and other platforms per OpenVAS/NVD entries) is affected by CVE-2009-4440 due to improper handling of multiple simultaneous client connections within a short time windo...

JVN#85821104 Active! mail 2003 session ID disclosure vulnerability

Active! mail 2003 from TransWARE Co. is a web-based email software. Active! mail 2003 contains a vulnerability in which session IDs may be disclosed. Impact A remote attacker could impersonate a user of Active! mail 2003. As a result, the user's email may be viewed or configurations may be...

Basic Analysis and Security Engine Detection

This host is running Basic Analysis and Security Engine BASE. BASE provides a web front-end to query and analyze the alerts coming from a SNORT IDS system. OpenVAS Vulnerability Test $Id: basedetect.nasl 5720 2017-03-24 14:15:57Z cfi $ Basic Analysis and Security Engine Detection Authors: Michael...

Basic Analysis and Security Engine Detection

This host is running Basic Analysis and Security Engine BASE. BASE provides a web front-end to query and analyze the alerts coming from a SNORT IDS system. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Eugene Kaspersky: My Thoughts on Internet Anonymity

There seems to be quite a loud response to what I thought was a rather simple idea. In this post, I am going to go over the main points – somewhere when I have more time I’ll share my ideas in detail so people could see exactly what I am proposing. 1. Common users are NOT anonymous for police and...

CVE-2009-3470

The vulnerability CVE-2009-3470 affects IBM Informix Dynamic Server (IDS) versions 10.00 before 10.00.xC11, 11.10 before 11.10.xC4, and 11.50 before 11.50.xC5. It allows remote attackers to cause a denial of service (memory corruption, assertion failure, and daemon crash) by sending a long passwo...