DSA-1802-2 squirrelmail - incomplete fix

Bulletin has no description...

Mandrake Security Advisory MDVSA-2009:110 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory MDVSA-2009:110. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

[SECURITY] [DSA 1802-1] New squirrelmail packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1802-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 19, 2009 http://www.debian.org/security/faq -...

DSA-1802-1 squirrelmail - several vulnerabilities

Bulletin has no description...

AjaxTerm ajaxterm.js会话劫持漏洞

BUGTRAQ ID: 34903 Ajaxterm是用python编写的基于web的开源终端。 AjaxTerm的ajaxterm.js脚本使用以下方式在客户端上分配会话id： var sid=""+Math.roundMath.random1000000000; 结合round使用的javascript随机函数没有为特定的会话id提供充足的熵，因此攻击者可以暴力猜测可能的id值并附加上已有的连接。此外由于在执行暴力猜测时还可能耗尽所有可用的会话id，利用这个漏洞还可能导致拒绝服务。 Antony Lesuisse AjaxTerm 0.10 Antony Lesuisse...

Code injection

ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to 1 hijack a session or 2 cause a denial of service session ID exhaustion via a brute-force attack...

CVE-2009-1629

ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to 1 hijack a session or 2 cause a denial of service session ID exhaustion via a brute-force attack...

CVE-2009-1580

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie...

CVE-2009-1629

CVE-2009-1629 affects Ajaxterm up to version 0.10 and earlier, where session IDs are generated with predictable random numbers via certain JavaScript functions. This can enable remote attackers to hijack sessions or trigger a denial of service through session ID exhaustion. Public advisories (Deb...

CVE-2009-1629

Removed by vendor...

CVE-2009-1580

CVE-2009-1580 refers to a session fixation vulnerability in SquirrelMail prior to version 1.4.18 . The issue allows remote attackers to hijack web sessions by supplying a crafted cookie, enabling session takeover with the privileges of the affected user. The provided documents explicitly identify...

openSUSE 10 Security Update : squirrelmail (squirrelmail-6242)

Multiple vulnerabilities have been fixed in SquirrelMail: an XSS and input sanitization bug both CVE-2009-1578, a server-side code execution CVE-2009-1579, a login session hijacking bug CVE-2009-1580 and another bug that allowed phishing and XSS attacks CVE-2009-1581. %NASLMINLEVEL 70300 C Tenabl...

[oCERT-2009-004] AjaxTerm session id collision

2009-004 AjaxTerm session id collision Description: AjaxTerm, an open source web based terminal, uses a form of random session id generation which can lead to remote session hijacking. The ajaxterm.js script allocates session ids on the client side using the following method: var...

Tiger Dms - Authentication Bypass

============================================================================== DDDDD OOOO SSSS DDDD ZZZZZZ TTTTTTTTT EEEEE A MM MM D D o O S D D Z T E A A M M M M D D o o SSSS D D Z T EEEEE AAAAA M M M D D o o S D D Z T E A A M M DDDD oooO SSSS DDDD ZZZZZZ T EEEEE A A M M...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving 1 administrative scripts or ...

Mandrake Linux Security Advisory : tomcat5 (MDKSA-2007:241)

A number of vulnerabilities were found in Tomcat : A directory traversal vulnerability, when using certain proxy modules, allows a remote attacker to read arbitrary files via a .. dot dot sequence with various slash, backslash, or url-encoded backslash characters CVE-2007-0450; affects Mandriva...

Banner Student System Cross Site Scripting

| | ||| ||| | | | | | || || By: gamr | | | | | | ||| ||| Header Product - Banner Student System by SunGard Specific Page - http://www.EXAMPLE.com/PATH/twbkwbis.PSecurityQuestion Change Security Question Version - 7.4 / earlier versions could be effected also Product URL -...

IBM WebSphere Application Server < 6.1.0.23 Multiple Vulnerabilities

Binary data 4996.prm...

CVE-2008-6722

CVE-2008-6722 affects Novell Access Manager 3 SP4. The vulnerability arises because SSL/X.509 sessions are not expired, allowing physically proximate attackers to reuse a victim’s valid SSL sessionID via the victim’s browser process. This is linked to Apache Tomcat’s failure to clear entries from...

Mandriva Update for tomcat5 MDKSA-2007:241 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDKSA-2007:241 tomcat5 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...