CVE-2007-1952: Improper Authentication

Session fixation vulnerability in onelook onebyone CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie...

CVE-2007-1966: Improper Authentication

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie...

CVE-2007-1953: Improper Authentication

Session fixation vulnerability in onelook courts on-line allows remote attackers to hijack web sessions by setting a PHPSESSID cookie...

IBM Rational ClearQuest Web - Cross Site Scripting

..........MMMMMMMM. ..... . .. ........7MMMMMMMMMM . .......... . ... ........OMMMMMMMMMM..................... ........8MMNMMMMMMMMMMMMMN.............. ........NMMMMMMMMMMMMMNNNND............. ....,DNMMMMMMMMMMMMMMMNDDD.............. ...DNNNNDMMMMMMMMMMMMMMNI...

knorrede-sql.txt

Author: Sebastian Bauer Web: http://blog.gjl-network.net Date: 01/12/07 Vuln. website: http://www.knorr.de Vulnerability: SQL Injection mainly login authentication bypass + any other SQL inj. possibility, XSS Significance: Very Critical ---------------------------------------------------------...

Advisory4-20022007.txt

--------------------------------------------------------------------------------- | . | | \ \ / /||/ | | | \ Y / | \ \ \ | \ \ \ / / | | \ / | || | /| | | | // \ | | / |||| || |/ //\ \ | | / / | | Security without illusions | | www.virtuax.be | | |...

vBulletin <= 3.6.4 (inlinemod.php postids) Remote SQL Injection Exploit

No description provided by source. ?php printr' ----------------------------------------------------------------------------- vBulletin = 3.6.4 inlinemod.php "postids" sql injection / privilege escalation by session hijacking exploit by rgod mail: retrog at alice dot it site:...

vBulletin <= 3.6.4 (inlinemod.php postids) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================================= vBulletin = 3.6.4 inlinemod.php postids Remote SQL Injection Exploit ======================================================================= ?php printr'...

vBulletin 3.6.4 - inlinemod.php?postids SQL Injection

vBulletin 3.6.4 - inlinemod.php?postids SQL Injection input-cleanarraygpc'p', array 'postids' = TYPESTR, ; $postids = exp...

vBulletin 3.6.4 - 'inlinemod.php?postids' SQL Injection

input-cleanarraygpc'p', array 'postids' = TYPESTR, ; $postids = explode',', $vbulletin-GPC'postids'; foreach $pos...

JVN#48566866 ColdFusion error page cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected ColdFusion MX 6.X ColdFusion MX 7.X For more information, refer to the vendor's website...

JVN#28356427 ColdFusion cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct a session hijacking. Solution Products Affected ColdFusion MX 7.X For more information, refer to the vendor's website...

JVN#14243645 Adobe JRun cross-site scripting vulnerability

Impact An arbitrary script may be executed on the browser of the administrator logged into Adobe JRun. In addition, if session information from a cookie is leaked, an remote attacker could possibly conduct session hijacking. Solution Products Affected Adobe JRun 4.0 ColdFusion MX 6.1 Enterprise...

Fixed in Apache Tomcat 6.0.9

Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. Affects:...

JVN#80271113 MODx cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected MODx 0.9.2.x and earlier...

JVN#64354801 b2evolution cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected b2evolution Version 1.9.1 beta and earlier b2evolution Version 1.8.6 and earlier...

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities source: https://www.securityfocus.com/bid/22191/info Multiple VoIP phones using the Aredfox PA168 Chipset are prone to a session-hijacking vulnerability due to a design error. An attacker can exploit this issue to gain administrative...

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities

source: https://www.securityfocus.com/bid/22191/info Multiple VoIP phones using the Aredfox PA168 Chipset are prone to a session-hijacking vulnerability due to a design error. An attacker can exploit this issue to gain administrative access to the embedded webserver running on the affected device...

JVN#13939411 Drupal cross-site scripting vulnerability

Impact An arbitrary script could be executed on the browser of the user who logged into Drupal. In addition, if session information from a cookie is leaked, a remote attacker could possibly conduct session hijacking. Solution Products Affected Drupal 4.6.10 and earlier Drupal 4.7.4 and earlier...

JVN#45006961 Joomla! cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information in a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected Joomla! 1.0.11 and earlier...