NetWin Surgemail 4.3e Cross Site Scripting

Application NetWin Surgemail 4.3e Vendor NetWin - http://netwinsite.com Discovered by Kerem Kocaer Problem ------- Cross-site scripting XSS vulnerability in the Surgemail webmail login page /surgemail allows remote attackers to inject arbitrary web script or HTML. Input passed to the "usernameex"...

Details Emerge on IE 8 Data-Stealing Bug

Security researcher Chris Evans has released details of the data-stealing bug in Internet Explorer 8 that he publicized earlier this month, saying that the CSS flaw can be used to force victims to post messages on Twitter and that the bug appears to be no closer to being fixed. The bug, which has...

Splunk Multiple vulnerabilities

This host is running Splunk and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodsplunkmultvuln.nasl 5401 2017-02-23 09:46:07Z teissa $ Splunk Multiple vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2010 SecPod, http://www.secpod.com This program is free...

Splunk 4.0.0 - 4.1.4 Multiple Vulnerabilities

Splunk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:splunk:splunk"; ifdescription...

CVE-2010-3471

CVE-2010-3471 impacts IBM FileNet P8 Application Engine (P8AE) 4.0.2.x, with a vulnerability in the Workplace component that allows session fixation and potential web-session hijacking. The issue is described as affecting all 4.0.2.x prior to 4.0.2.7-P8AE-FP007 and is triggered through unspecifie...

CVE-2010-3323

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKDSESSIONKEY parameter...

Session fixation

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKDSESSIONKEY parameter...

CVE-2010-3323

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKDSESSIONKEY parameter...

CVE-2010-3323

Splunk 4.0.0–4.1.4 is vulnerable to remote session hijacking; the root cause is exposure of the splunkd session key via vectors related to the SPLUNKD_SESSION_KEY parameter. Impact is disclosure of the session key and potential unauthorized access. No patch/version remediation details are provide...

Mandriva Update for tomcat5 MDVSA-2010:176 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDVSA-2010:176 tomcat5 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for tomcat5 MDVSA-2010:176 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDVSA-2010:176 tomcat5 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users’ online banking sessions and cause other severe problems in vulnerable applications. Experts say...

Mandriva Linux Security Advisory : tomcat5 (MDVSA-2010:176)

Multiple vulnerabilities has been found and corrected in tomcat5 : Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote ' characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive informatio...

Nasty Data-Stealing Bug Haunts Internet Explorer 8

There’s an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user’s authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the wa...

Fedora 14 : php-pear-CAS-1.1.2-1.fc14 (2010-12320)

Security fixes Fix a session hijacking hole CVE-2010-2795 PHPCAS-61 callbackurl in proxy mode should be urlencoded, possible XSS CVE-2010-2796 PHPCAS-67 Bug fixes Fix warnings for SAML responses without attributes PHPCAS-59 Fix duplicate SAML debug output PHPCAS-64 Providing a new ST/PT/SA during...

Fedora 13 : php-pear-CAS-1.1.2-1.fc13 (2010-12258)

Security fixes Fix a session hijacking hole CVE-2010-2795 PHPCAS-61 callbackurl in proxy mode should be urlencoded, possible XSS CVE-2010-2796 PHPCAS-67 Bug fixes Fix warnings for SAML responses without attributes PHPCAS-59 Fix duplicate SAML debug output PHPCAS-64 Providing a new ST/PT/SA during...

Fedora 12 : php-pear-CAS-1.1.2-1.fc12 (2010-12247)

Security fixes Fix a session hijacking hole CVE-2010-2795 PHPCAS-61 callbackurl in proxy mode should be urlencoded, possible XSS CVE-2010-2796 PHPCAS-67 Bug fixes Fix warnings for SAML responses without attributes PHPCAS-59 Fix duplicate SAML debug output PHPCAS-64 Providing a new ST/PT/SA during...

phpCAS Session Hijacking and Cross-Site Scripting Vulnerabilities

This host is installed with phpCAS and is prone to session hijacking and cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbphpcassessionhijacknxssvuln.nasl 7823 2017-11-20 08:54:04Z cfischer $ phpCAS Session Hijacking and Cross-Site Scripting Vulnerabilities Authors: Madhuri...

phpCAS Session Hijacking and Cross-Site Scripting Vulnerabilities

phpCAS is prone to session hijacking and cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

2Wire Broadband Router Session Hijacking Vulnerability

========================================== 2Wire Broadband Router Session Hijacking Vulnerability ========================================== 1. OVERVIEW The 2Wire Broadband Router is vulnerable to Session Hijacking flaw which attackers can compromise the router administrator session. 2. PRODUCT...