4853 matches found
CVE-2006-3583
CVE-2006-3583 describes a session- fixation vulnerability in Jetbox CMS 2.1 SR1 . The root cause involves login/session handling flaws and unsanitised input in server-side scripts (notably in index.php and admin/cms/index.php), enabling an attacker to hijack a user’s session via a crafted link an...
CVE-2006-3583: Improper Authentication
Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section...
[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities
MajorSecurity 26 Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities ---------------------------------------------------------------------------------------- Software: Woltlab Burning board Impact: Cookie manipulation and Session Fixation Made public: July,...
FreeBSD : drupal -- multiple vulnerabilities (6779e82f-b60b-11da-913d-000ae42e9b93)
Drupal reports : Mail header injection vulnerability. Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Session fixation...
Session fixation
Adobe Document Server for Reader Extensions 6.0 includes a user's session jsession ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session...
Session fixation
gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosedownGrabs enabled, allows attackers with physical access to cause the screensaver to crash and access the session via the Ctl+Alt+Keypad-Multiply keyboard sequence, which removes the grab from gnome...
Session fixation
Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...
CVE-2006-1228
Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...
CVE-2006-1228
Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...
CVE-2006-1228
Drupal is affected by CVE-2006-1228 (session fixation) in 4.5.x before 4.5.8 and 4.6.x before 4.5.8. The issue allows a remote attacker to gain Drupal user privileges by enticing a user to click a URL that fixes the session identifier. Publicly documented impact is user privilege elevation via cr...
CVE-2006-1228
Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...
[DRUPAL-SA-2006-003] Drupal 4.6.6 / 4.5.8 fixes session fixation issue
---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2006-003 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2006-003 Project: Drupal core Date: 2006-03-13 Security risk: less critical...
CVE-2006-1228: Improper Authentication
Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...
drupal -- multiple vulnerabilities
Drupal reports: Mail header injection vulnerability. Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Session fixation...
DRUPAL-SA-2006-003 Session fixation vulnerability
If someone creates a clever enough URL and convinces you to click on it, and you later log in but you do not log off then the attacker may be able to impersonate you. Versions affected All Drupal versions before 4.6.6. Solution The fix to this issue requires PHP 4.3.2 or higher, which is higher...
Session fixation
claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...
CVE-2005-4731
The Next action in PEAR HTMLQuickFormController 1.0.4 includes the SID in the URL even when session.useonlycookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors...
CVE-2001-1534: Session Fixation
modusertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication...
FreeBSD : kdelibs -- konqueror cross-domain cookie injection (2797b27a-f55b-11d8-81b0-000347a4fa7d)
According to a KDE Security Advisory : WESTPOINT internet reconnaissance services alerted the KDE security team that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. Websites operating under the affected domains can set HTTP...