Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection

Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a l...

Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection

A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one product. It would seem as if the...

Perl$hop e-commerce Script Trust Boundary Input Parameter Injection

No description provided by source. A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one...

CVE-2009-2583

Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager ITIM 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the 1 console and 2 self service interfaces...

Session fixation

Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager ITIM 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the 1 console and 2 self service interfaces...

CVE-2009-2583

Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager ITIM 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the 1 console and 2 self service interfaces...

CVE-2009-2583

CVE-2009-2583 describes multiple session fixation vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0.0.6 . The issue allows remote attackers to hijack web sessions via unspecified vectors involving the console and self service interfaces . The description does not specify the exact exploit...

Session fixation

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session...

Session fixation

The pciregisteriommuregion function in arch/sparc/kernel/pcicommon.c in the Linux kernel before 2.6.29 on the sparc64 platform allows local users to cause a denial of service system crash by reading the /proc/iomem file, related to uninitialized pointers and the requestresource function...

SquirrelMail Command Execution Vulnerability

SquirrelMail Web application is prone to a command execution vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Session fixation

The ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not 1 encrypt mouse events, which makes it easier for man-in-the-middle attackers to perform mouse operations on machines connected to the switch by injecting network traffic; and do not 2 s...

SquirrelMail contrib/decrypt_headers.php XSS

The installed version of SquirrelMail fails to sanitize user-supplied input before using it in the 'contrib/decryptheaders.php' script to dynamically generate HTML. An unauthenticated attacker can exploit this issue to launch cross-site scripting attacks against the affected application. There ar...

Session fixation

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie...

CVE-2009-1580

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie...

CVE-2009-1580

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie...

CVE-2009-1580

CVE-2009-1580 refers to a session fixation vulnerability in SquirrelMail prior to version 1.4.18 . The issue allows remote attackers to hijack web sessions by supplying a crafted cookie, enabling session takeover with the privileges of the affected user. The provided documents explicitly identify...

SquirrelMail < 1.4.18 Multiple Vulnerabilities

SquirrelMail is prone to multiple vulnerabilities, including multiple session-fixation issues, a code-injection issue, and multiple cross-site scripting issues. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

osCommerce 'oscid' Session Fixation Vulnerability

osCommerce is prone to a session-fixation vulnerability. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

osCommerce 'oscid' Session Fixation Vulnerability

osCommerce is prone to a session-fixation vulnerability. Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application. The following are vulnerable: osCommerce 2.2 osCommerce 3.0 Beta Other versions may also be affected. OpenVAS Vulnerabilit...

osCommerce oscid会话固定漏洞

BUGTRAQ ID: 34348 osCommerce是一套基于GNUGPL授权的开源在线购物电子商务解决方案。 当客户端访问OSCommerce网页时，服务器会发送一个cookie，并将该cookie用作所有之后请求的会话cookie。因此，一旦登录成功，所有之后的请求都会用这个cookie来认证用户，这样攻击者就可以劫持会话执行各种非授权操作。 Harald Ponce de Leon OSCommerce 3.0 Beta Harald Ponce de Leon OSCommerce 2.2 厂商补丁： Harald Ponce de Leon...