New FireSheep-Style Tool Hijacks Twitter Sessions

Days after researchers at the ToorCon Security Conference in San Diego released a tool to hijack insecure Web sessions on Facebook, iGoogle and Flickr, a developer has released a similar tool, dubbed “Idiocy” that does the same for insecure Twitter sessions. There’s a twist, though. Rather than...

MVSA-10-002 - Google Message Security SaaS - Multiple XSS vulnerabilities

Security Advisory: MVSA-10-002 Vendor: Google Service: Google Message Security SaaS powered by Postini - Security Console Admin Console - Message Center Classic - Message Center II Vulnerabilities: Multiple Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Authentication: Required...

Google Message Security SaaS Cross Site Scripting

Security Advisory: MVSA-10-002 Vendor: Google Service: Google Message Security SaaS powered by Postini - Security Console Admin Console - Message Center Classic - Message Center II Vulnerabilities: Multiple Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Authentication: Required...

MVSA-10-007 / CVE-2010-0152 - IBM Proventia Mail Security System - Multiple persistent and reflected XSS vulnerabilities

Security Advisory: MVSA-10-007 / CVE-2010-0152 Vendor: IBM Products: Proventia Network Mail Security System Vulnerabilities: Multiple Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Authentication: Not Required/Required Reference:...

Proventia Network Mail Security System Cross Site Scripting

Security Advisory: MVSA-10-007 / CVE-2010-0152 Vendor: IBM Products: Proventia Network Mail Security System Vulnerabilities: Multiple Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Authentication: Not Required/Required Reference:...

CVE-2010-2795

phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value...

CVE-2010-2795

phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value...

CVE-2010-2270

CVE-2010-2270 affects Accoria Web Server (Rock Web Server) 1.4.7. The vulnerability is due to a predictable httpmod-sessionid cookie used for session management, enabling remote attackers to hijack sessions via a modified cookie. Root cause: predictable session identifiers in the server’s cookie ...

aMSN < 0.97.1 Session Hijack Vulnerability - Windows

aMSN is prone to a session hijacking vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

aMSN session hijack vulnerability (Windows)

This host is installed with aMSN and is prone to session hijack vulnerability. OpenVAS Vulnerability Test $Id: secpodamsnsessionhijackvulnwin.nasl 7573 2017-10-26 09:18:50Z cfischer $ aMSN session hijack vulnerability Windows Authors: Madhuri D Copyright: Copyright c 2010 SecPod,...

Joomla Password Reset Weakness and Session Fixation Vulnerability

No description provided by source. A weakness and a vulnerability have been reported in Joomla, which can be exploited by malicious people to disclose sensitive information and conduct session fixation attacks. 1 The weakness is caused due to password reset tokens being stored in plain text in th...

CVE-2008-7255

loginscreen.tcl in aMSN aka Alvaro's Messenger before 0.97.1 saves a password after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation...

Croogo CMS 1.2 Cross Site Scripting Vulnerabilities

Croogo CMS 1.2 Cross Site Scripting Vulnerabilities ========================================== Vulnerable Software: 1.2 and prior Release Date: 2010-03-06 Last Update: 2010-02-01 Critical: Low Impact: Session hijack Denial of service Code execution Solution Status: Webvuln has informed and...

Croogo CMS versions 1.2 Cross Site Scripting Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Croogo CMS versions 1.2 Cross Site Scripting Vulnerabilities ============================================================ Vulnerable Software: 1.2 and prior Release Date:...

Croogo CMS 1.2 Cross Site Scripting

Croogo CMS 1.2 Cross Site Scripting Vulnerabilities ========================================== Vulnerable Software: 1.2 and prior Release Date: 2010-03-06 Last Update: 2010-02-01 Critical: Low Impact: Session hijack Denial of service Code execution Solution Status: Webvuln has informed and...

drupal -- multiple vulnerabilities

Drupal Team reports: A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attack. The exploit can only be conducted on sites not yet installed. The API function drupalgoto is susceptible to a phishing attack. An...

CVE-2009-4655

The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie...

CVE-2009-4655

CVE-2009-4655 affects Novell eDirectory 8.8.5 DHOST web service, which uses a predictable session cookie that can enable session hijacking by a remote attacker. The PacketStorm/MSF and Nessus/OpenVAS entries corroborate a cookie-based hijack vector tied to DHost. Evidence notes the vulnerability ...

Debian DSA-1944-1 : request-tracker3.4 request-tracker3.6 - session hijack

Mikal Gule discovered that request-tracker, an extensible trouble-ticket tracking system, is prone to an attack, where an attacker with access to the same domain can hijack a user's RT session. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

OpenJDK Proxy mechanism information leaks (6801071)

The proxy mechanism implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted 1 applets and 2 Java Web Start applications, which allows remote attackers to hijack web sessions...