phpRPG 0.8 - tmp Directory PHPSESSID Cookie Session Hijacking

phpRPG 0.8 - tmp Directory PHPSESSID Cookie Session Hijacking source: https://www.securityfocus.com/bid/26884/info phpRPG is prone to two vulnerabilities: - An SQL-injection vulnerability - A vulnerability that lets remote attackers gain access to sessions. Exploiting these issues may allow an...

CVE-2007-5614

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors...

CVE-2007-5614

CVE-2007-5614 affects Mortbay Jetty prior to 6.1.6rc1, where improper handling of certain quote sequences in HTML cookie parameters can lead to remote session hijacking via unspecified vectors. This is documented in the original vulnerability description plus multiple vulnerability references (in...

Mortbay Jetty fails to properly handle cookies with quotes

Overview Mortbay Jetty fails to properly handle cookie quotes, which may allow session hijacking. Description Mortbay Jetty is a web server that is written in Java. Jetty fails to properly handle cookies with certain quote sequences. This can cause the Jetty cookie parsing mechanism to improperly...

USN-549-2: PHP regression

USN-549-1 fixed vulnerabilities in PHP. However, some upstream changes were incomplete, which caused crashes in certain situations with Ubuntu 7.10. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the wordwrap function did not...

Moderate: Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server

Updated tomcat packages that fix multiple security issues are now available for Red Hat Network Satellite Server. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Tomcat is a servlet container for Java Servlet and JavaServer Pages technologies. ...

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

tomcat handling of cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and ColdFusion MX 7 are affected by a remote session-fixation vulnerability. The issue arises when established sessions in a ColdFusion application can be hijacked if CFID/CFTOKEN cookies are empty, enabling an attacker to impersonate a user. The CVE-2007-5905 entry lists these...

Adobe ColdFusion CFID/CFTOKEN会话劫持漏洞

BUGTRAQ ID: 26429 CVECAN ID: CVE-2007-5905 ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion在处理用户会话时存在漏洞，远程攻击者可能利用此漏洞获取敏感信息。 对于使用ColdFusion编译的应用程序，远程攻击者可以通过CFID或CFTOKEN劫持应用程序的用户会话，然后就可以浏览敏感信息或扮演成为合法用户执行请求。使用J2EE会话管理的用户不受这个漏洞影响。 Adobe...

CVE-2007-0011

The web portal interface in Citrix Access Gateway aka Citrix Advanced Access Control before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or...

Input validation

The web portal interface in Citrix Access Gateway aka Citrix Advanced Access Control before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or...

CVE-2007-0011

The web portal interface in Citrix Access Gateway aka Citrix Advanced Access Control before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or...

CVE-2007-0011

The CVE-2007-0011 issue affects Citrix Access Gateway (also Citrix Advanced Access Control) prior to Advanced Edition 4.5 HF1. The vulnerability is that a session ID is placed in the URL during the web portal authentication flow, enabling context-dependent attackers to hijack a user session by re...

tomcat handling of cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

CVE-2003-1481

CommuniGate Pro versions 3.1–4.0.6 are affected by a flaw where the session ID is exposed in the Referer header of an image request. This enables remote attackers to hijack mail sessions by sending an email containing an IMG tag referencing a malicious URL that captures the Referer. Impact is use...

SYMSA-2007-013: Lotus Notes Memory Mapped Files Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2007-013 Advisory Title: Lotus Notes Memory Mapped Files Vulnerability Author: Ollie Whitehouse / [email protected] Release Date: 23-10-20...

netgear-xss.txt

----------------------------- || WWW.SMASH-THE-STACK.NET || ----------------------------- || ADVISORY: NETGEAR SSL312 XSS VULNERABILITY || 0x00: ABOUT ME || 0x01: DATELINE || 0x02: INFORMATION || 0x03: EXPLOITATION || 0x04: RISK LEVEL || 0x00: ABOUT ME Author: SkyOut Date: October 2007 Contact:...