6598 matches found
Session hijacking attack demo(three)-vulnerability warning-the black bar safety net
...
Session hijacking attack demo(a)-vulnerability warning-the black bar safety net
...
CVE-2008-5809
futomi CGI Cafe Access Analyzer CGI Standard 4.0.1 and earlier and Access Analyzer CGI Professional 4.11.3 and earlier use a predictable session id, which makes it easier for remote attackers to hijack sessions, and obtain sensitive information about analysis results, via a modified id...
Design/Logic Flaw
futomi CGI Cafe Access Analyzer CGI Standard 4.0.1 and earlier and Access Analyzer CGI Professional 4.11.3 and earlier use a predictable session id, which makes it easier for remote attackers to hijack sessions, and obtain sensitive information about analysis results, via a modified id...
CVE-2008-5809
The CVE-2008-5809 affects futomi CGI Cafe’s Access Analyzer CGI: Standard v4.0.1 and earlier and Professional v4.11.3 and earlier, where a predictable session ID enables remote attackers to hijack sessions and view analysis results. Root cause: predictable session identifiers. Impact: partial dis...
CVE-2008-5670
Textpattern aka Txp CMS 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session...
CVE-2008-5670
Textpattern aka Txp CMS 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session...
Default credentials
Textpattern aka Txp CMS 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session...
Joomla: Session hijacking vulnerability, CVE-2008-4122
Joomla: Session hijacking vulnerability, CVE-2008-4122 References https://vulners.com/cve/CVE-2008-4122 http://int21.de/cve/CVE-2008-4122-joomla.html http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/ https://www.defcon.org/html/defcon-16/dc-16-speakers.htmlPerry Description...
DISCUZ all versions of COOKIE hijacking method+DEMO-vulnerability warning-the black bar safety net
DISCUZ and many forums are unable to perform session hijacking, because the session and IP binding, DISCUZ main session authentication mechanism is as follows: /inlude/common.inc.php //Section 1 3 6 verify the session important period is from the sessions table in the query the SID, which is an...
CVE-2008-5343
Vulnerability GIFAR (CVE-2008-5343) affects Java Web Start (JWS) and Java Plug-in in Sun JDK/JRE 6u10 and earlier, JDK/JRE 5.0u16 and earlier, and SDK/JRE 1.4.2_18 and earlier. A crafted file that validates as both GIF and Java JAR can allow remote attackers to make unauthorized network connectio...
Java WebStart allows hidden code privilege escalation
Java Web Start JWS and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.218 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF an...
GLSA-200812-07 : Mantis: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200812-07 Mantis: Multiple vulnerabilities Multiple issues have been reported in Mantis: EgiX reported that manageprojpage.php does not correctly sanitize the sort parameter before passing it to createfunction in core/utilityapi.p...
Mantis: Multiple vulnerabilities
Background Mantis is a PHP/MySQL/Web based bugtracking system. Description Multiple issues have been reported in Mantis: EgiX reported that manageprojpage.php does not correctly sanitize the sort parameter before passing it to createfunction in core/utilityapi.php CVE-2008-4687. Privileges of...
FreeBSD : mantis -- session hijacking vulnerability (00d6040a-b8e0-11dd-a578-0030843d3802)
The mantis Team reports : When configuring a web application to use only ssl e. g. by forwarding all http-requests to https, a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Else...
openSUSE 10 Security Update : squirrelmail (squirrelmail-5792)
Squirrelmail was updated to use the secure flag for its cookies. Otherwise it was possible to hijack a SSL-protected session via leaked cookies. CVE-2008-3663 The previous update for the problem above contained a typo which broke squirrelmail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
Apoll 0.7b - Authentication Bypass
Apoll version Remote Auth Bypass Vulnerability version: beta 0.7 script dwonload: http://www.miticdjd.com/download/3/ ---------------------------------------------------------- Discovered By: ZoRLu Date: 03.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi...
PhpWebGallery <= 1.7.2 Session Hijacking / Code Execution Exploit
No description provided by source. ?php / ------------------------------------------------------------------------ PhpWebGallery = 1.7.2 Remote Session Hijacking / Code Execution Exploit ------------------------------------------------------------------------ author...: EgiX mail.....:...
phpwebgallery-hijackexec.txt
$b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see http://www.securityfocus.com/bid/31398. Only admin can access to the plugins management interface, but the attacker might be able to retrieve a valid...
PhpWebGallery <= 1.7.2 Session Hijacking / Code Execution Exploit
Exploit for unknown platform in category web applications ================================================================= PhpWebGallery $b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see...