6487 matches found
Отправка команд от имени пользователя IRC в XChat (session hijacking)
При ответе на команду ping копируются посланные данные без проверки их содержимого, что может привести к выполнению команды...
xchat IRC session hijacking vulnerability (versions 1.4.1, 1.4.2)
========================================================================== ======= xchat 1.4.2 and 1.4.3 IRC session hijacking vulnerability ======== ========================================================================== It is possible to trick xchat IRC clients 1.4.2, 1.4.3 into sending...
PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting
PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting source: https://www.securityfocus.com/bid/3807/info phptonuke.php is a PHPNuke AddOn script to insert a PHP script into the middle of a PHPNuke site. It is written and maintained by Lebios. It is possible for a malicious user to create a lin...
PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting
source: https://www.securityfocus.com/bid/3807/info phptonuke.php is a PHPNuke AddOn script to insert a PHP script into the middle of a PHPNuke site. It is written and maintained by Lebios. It is possible for a malicious user to create a link to the phptonuke.php script which contains script code...
CVE-2001-1532
WebX stores authentication information in the HTTPREFERER variable, which is included in URL links within bulletin board messages posted by users, which could allow remote attackers to hijack user sessions...
Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting
source: https://www.securityfocus.com/bid/3714/info Aktivate is a shopping cart system which is geared towards Unix and Linux users, uses MySQL as a backend, and is written in Perl. Aktivate is prone to cross-site scripting attacks. It is possible to construct a link containing arbitrary script...
Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting
Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting source: https://www.securityfocus.com/bid/3714/info Aktivate is a shopping cart system which is geared towards Unix and Linux users, uses MySQL as a backend, and is written in Perl. Aktivate is prone to cross-site scripting attacks. It is possib...
Agora.CGI 3.x4.0 - Debug Mode Cross-Site Scripting
Agora.CGI 3.x4.0 - Debug Mode Cross-Site Scripting source: https://www.securityfocus.com/bid/3702/info Agora.cgi is a freely available, open source shopping cart system. When debug mode is enabled, the Agora.cgi script does not adequately filter HTML tags when debug information is being output...
Agora.CGI 3.x/4.0 - Debug Mode Cross-Site Scripting
source: https://www.securityfocus.com/bid/3702/info Agora.cgi is a freely available, open source shopping cart system. When debug mode is enabled, the Agora.cgi script does not adequately filter HTML tags when debug information is being output. Debug mode is not enabled by default and must be...
NMRC Advisory - NetDynamics Session ID is Reusable
I N F O R M A T I O N A N A R C H Y 2 K 0 1 www.nmrc.org/InfoAnarchy Nomad Mobile Research Centre A D V I S O R Y www.nmrc.org Phuzzy L0gic [email protected] 27Nov2001 Platform : Sun Solaris Version 7, 8 Application : NetDynamics 4.x, 5.x Severity : Medium Synopsis -------- It appears that the...
CVE-2001-0922
ndcgi.exe in Netdynamics 4.x through 5.x, and possibly earlier versions, allows remote attackers to steal session IDs and hijack user sessions by reading the SPIDERSESSION and uniqueValue variables from the login field, then using those variables after the next user logs in...
Imp Webmail session hijacking vulnerability
It's possible to hijack an imp/horde session using a cross-site script attack, quite similar to the one explored by Marc Slemko in his "Microsoft Passport to Trouble" paper. - After hijacking the cookies, the attacker can use the session and read the victim's mail. - Imp...
Horde IMP 2.2.x - Session Hijacking
Horde IMP 2.2.x - Session Hijacking source: https://www.securityfocus.com/bid/3525/info IMP is a powerful web-based mail interface/client developed by members of the Horde project. Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to...
Horde IMP 2.2.x - Session Hijacking
source: https://www.securityfocus.com/bid/3525/info IMP is a powerful web-based mail interface/client developed by members of the Horde project. Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to construct a link which when clicked wi...
CVE-2001-1284
Ipswitch IMail 7.04 and earlier uses predictable session IDs for authentication, which allows remote attackers to hijack sessions of other users...
CVE-2001-1286
Ipswitch IMail 7.04 and earlier stores a user's session ID in a URL, which could allow remote attackers to hijack sessions by obtaining the URL, e.g. via an HTML email that causes the Referrer to be sent to a URL under the attacker's control...
Ipswitch Imail 7.04 vulnerabilities
Hi all, Below are vulnerabilities I have found in Imail Ipswitch.com. Some of them can be very dangerous and it is there for recommended that Imail users upgrade their software asap. After reporting these vulnerabilities to Ipswitch on the 4e of this month it only took 7 days before Ipswitch...
CVE-1999-1268
Vulnerability in KDE konsole allows local users to hijack or observe sessions of other users by accessing certain devices...
CVE-1999-1076
Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an application that attempts to verify that the user wants to log out, which returns the attacker into th...