CVE-2007-1966: Improper Authentication

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie...

CVE-2007-1952: Improper Authentication

Session fixation vulnerability in onelook onebyone CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie...

CVE-2007-1949: Improper Authentication

Session fixation vulnerability in WebBlizzard CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie...

CVE-2007-1951: Improper Authentication

Session fixation vulnerability in onelook obo Shop allows remote attackers to hijack web sessions by setting a PHPSESSID cookie...

CVE-2007-1953: Improper Authentication

Session fixation vulnerability in onelook courts on-line allows remote attackers to hijack web sessions by setting a PHPSESSID cookie...

[MajorSecurity Advisory #42]webblizzard CMS - Cross Site Scripting and Session fixation Issues

MajorSecurity Advisory 42webblizzard CMS - Cross Site Scripting and Session fixation Issues Details ======= Product: webblizzard CMS Remote-Exploit: yes Vendor-URL: http://www.webblizzard.de/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz...

[MajorSecurity Advisory #39]onelook onebyone CMS - Session fixation Issue

MajorSecurity Advisory 39onelook onebyone CMS - Session fixation Issue Details ======= Product: onebyone CMS Remote-Exploit: yes Vendor-URL: http://www.onebyone.ch/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz http://www.majorsecurity.de...

[MajorSecurity Advisory #41]onelook courts online - Session fixation Issue

MajorSecurity Advisory 41onelook courts online - Session fixation Issue Details ======= Product: courts online Remote-Exploit: yes Vendor-URL: http://www.onebyone.ch/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz http://www.majorsecurity....

[MajorSecurity Advisory #40]onelook oboShop - Session fixation Issue

MajorSecurity Advisory 40onelook oboShop - Session fixation Issue Details ======= Product: oboShop Remote-Exploit: yes Vendor-URL: http://www.onebyone.ch/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz http://www.majorsecurity.de Original...

[MajorSecurity Advisory #38]eXV2 CMS - Session fixation and Cross-Site-Scripting Issues

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

Mozilla Foundation Security Advisory 2007-07

Mozilla Foundation Security Advisory 2007-07 Title: Embedded nulls in location.hostname confuse same-domain checks Impact: High Announced: February 23, 2007 Reporter: Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.2 Firefox 1.5.0.10 SeaMonkey 1.0.8 Description Michal Zalewsk...

Session fixation

Cisco IOS after 12.314T, 12.38YC1, 12.38YG, and 12.4, with voice support and without Session Initiated Protocol SIP configured, allows remote attackers to cause a denial of service crash by sending a crafted packet to port 5060/UDP...

Debian DSA-1007-1 : drupal - several vulnerabilities

The Drupal Security Team discovered several vulnerabilities in Drupal, a fully-featured content management and discussion engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-1225 Due to missing input sanitising a remote attacker could inject...

CVE-2006-3583

Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section...

CVE-2006-3583

Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section...

CVE-2006-3583

CVE-2006-3583 describes a session- fixation vulnerability in Jetbox CMS 2.1 SR1 . The root cause involves login/session handling flaws and unsanitised input in server-side scripts (notably in index.php and admin/cms/index.php), enabling an attacker to hijack a user’s session via a crafted link an...

CVE-2006-3583: Improper Authentication

Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section...

[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities

MajorSecurity 26 Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities ---------------------------------------------------------------------------------------- Software: Woltlab Burning board Impact: Cookie manipulation and Session Fixation Made public: July,...

FreeBSD : drupal -- multiple vulnerabilities (6779e82f-b60b-11da-913d-000ae42e9b93)

Drupal reports : Mail header injection vulnerability. Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Session fixation...

Session fixation

Adobe Document Server for Reader Extensions 6.0 includes a user's session jsession ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session...