Fixed in Apache Tomcat 6.0.14

Low: Cross-site scripting CVE-2007-2449 JSPs within the examples web application did not escape user provided data before including it in the output. This enabled a XSS attack. These JSPs now filter the data before use. This issue may be mitigated by undeploying the examples web application. Note...

Mambo 4.6.2 CMS - Session fixation Issue in backend Administration interface

==================================================================================== Team Intell Security Advisory TISA2007-04 ------------------------------------------------------------------------------------ Mambo 4.6.2 CMS - Session fixation Issue in backend Administration interface...

joomla -- multiple vulnerabilities

A Secunia Advisory reports: joomla can be exploited to conduct session fixation attacks, cross-site scripting attacks or HTTP response splitting attacks. Certain unspecified input passed in comsearch, comcontent and modlogin is not properly sanitised before being returned to a user. This can be...

CVE-2007-3978: Undefined Security Weakness

Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2004-2681: Undefined Security Weakness

PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a session...

Simple Machines Forum < 1.1.3 PHPSESSIONID Cookie Session Hijacking

Binary data 4101.prm...

JVN#63602912 dotProject cross-site scripting vulnerability

This vulnerability is different from JVN97636431. Impact An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, session hijacking could be conducted. Solution Update the Software The developer has released dotProject version 2...

CVE-2007-3053: Undefined Security Weakness

Session fixation vulnerability in Calimero.CMS 3.3.1232 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2007-2978: Improper Link Resolution Before File Access

Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

Design/Logic Flaw

Packeteer PacketShaper uses fixed increments in TCP initial sequence number ISN values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption...

CVE-2007-2782

CVE-2007-2782 concerns Packeteer PacketShaper where fixed increments in TCP initial sequence number (ISN) values make ISNs predictable, enabling remote attackers to predict the ISN and potentially hijack or disrupt sessions. Root cause: deterministic ISN generation. Exploitation details beyond pr...

CVE-2007-2782

Packeteer PacketShaper uses fixed increments in TCP initial sequence number ISN values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption...

CVE-2007-2782: Undefined Security Weakness

Packeteer PacketShaper uses fixed increments in TCP initial sequence number ISN values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption...

HP Systems Insight Manager for Windows unauthorized access

Invalid session cookie processing allows administrative session hijacknig...

CVE-2007-2719: Improper Authentication

Session fixation vulnerability in HP Systems Insight Manager SIM 4.2 and 5.0 SP4 and SP5 allows remote attackers to hijack web sessions by setting the JSESSIONID cookie...

Then talk about the Exchange environment session hijacking(For windows2000)-vulnerability warning-the black bar safety net

The first step is to open the IP Routing function, modify the registry HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter to 0x1, and restart the system. The second step is ARP spoofing, the specific principle I will not say. The third step is to start the hijackin...

Nuked-klaN 1.7.6 - Remote Code Execution

Website: http://www.acid-root.new.fr/ PHP conditions: None = Private since 2 months. errorreportingEALL ^ ENOTICE; This file require the PhpSploit class. $xpl = new phpsploit; $url = 'http://localhost/nk/'; url $prx = ''; proxy : $pra = ''; basic authentification $xpl-agent"Firefox";...

jafcms-xss.txt

JAF CMS - 4.0 Cross Site Scripting Vulnerability Source: http://sourceforge.net/projects/jaf-cms/ Author: Arham Muhammad POC: http://site/path/index.php?show="alert/xss/; There Is No Sign Of Filteration In Jaf-Cms, Making It Prune To Xss And Session Hijacking!...

CVE-2007-2277: Improper Authentication

Session fixation vulnerability in Plogger allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

JVN#84646028 open-gorotto cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected open-gorotto 2.0a 04/07/2006 and earlier...