krb5 -- multiple checksum handling vulnerabilities

The MIT Kerberos team reports: MIT krb5 clients incorrectly accept an unkeyed checksums in the SAM-2 preauthentication challenge. An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some...

Session fixation

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKDSESSIONKEY parameter...

Pivot 1.40.4-7 Multiple Remote Vulnerabilities

No description provided by source. Pivot - XSS and HTML Injection Vulnerabilities Versions Affected: 1.40.4 and 1.40.7 22nd March 2009 newest Info: Pivot is a web-based tool to help you maintain dynamic sites, like weblogs or online journals. Pivot is released under the GPL so it is completely fr...

CVE-2009-1473

The 1 Windows and 2 Java client programs for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not properly use RSA cryptography for a symmetric session-key negotiation, which makes it easier for remote attackers to a decrypt network traffi...

ATEN IP KVM Switches multiple cryptographic vulnerabilities

Same SSL certificate is used for all devices, static symmetric key is used for code signing, mouse events are not encrypted, predictable session key is used...

OLIB 7 WebView 2.5.1.1 (infile) Local File Inclusion Vulnerability

No description provided by source. Security Advisory for 'OLIB 7 Webview' This software is apart of Moodle. Software - OLIB 7 WebView v2.5.1.1 Exploit - LFI Severity - High Author - ZeN website - http://dusecurity.com/ Date - 2nd October 2008 DUSecurity Team / DarkCode Exploit...

OLIB 7 WebView 2.5.1.1 - 'infile' Local File Inclusion

Security Advisory for 'OLIB 7 Webview' This software is apart of Moodle. Software - OLIB 7 WebView v2.5.1.1 Exploit - LFI Severity - High Author - ZeN website - http://dusecurity.com/ Date - 2nd October 2008 DUSecurity Team / DarkCode Exploit http://olib.site.com/cgi/?session=sessionkey&infile=LF...

olibwebview-lfi.txt

Security Advisory for 'OLIB 7 Webview' This software is apart of Moodle. Software - OLIB 7 WebView v2.5.1.1 Exploit - LFI Severity - High Author - ZeN website - http://dusecurity.com/ Date - 2nd October 2008 DUSecurity Team / DarkCode Exploit http://olib.site.com/cgi/?session=sessionkey&infile=LF...

OLIB 7 WebView 2.5.1.1 (infile) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== OLIB 7 WebView 2.5.1.1 infile Local File Inclusion Vulnerability ================================================================== Security Advisory for 'OLIB 7 Webview'...

OLIB 7 WebView 2.5.1.1 - infile Local File Inclusion

OLIB 7 WebView 2.5.1.1 - infile Local File Inclusion Security Advisory for 'OLIB 7 Webview' This software is apart of Moodle. Software - OLIB 7 WebView v2.5.1.1 Exploit - LFI Severity - High Author - ZeN website - http://dusecurity.com/ Date - 2nd October 2008 DUSecurity Team / DarkCode Exploit...

CVE-2006-4943

course/jumpto.php in Moodle before 1.6.2 does not validate the session key sesskey before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter...

CVE-2006-4943

course/jumpto.php in Moodle before 1.6.2 does not validate the session key sesskey before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter...

CVE-2004-2681

PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a session...

PKCS#1 Version 1.5 Session Key Retrieval

Binary data 1971.prm...

Dameware weak encryotion

Session key is generated from static set...

Certain implementations of SSH1 may reveal internal cryptologic state

Overview An implementation problem in at least one Secure Shell SSH product and a weakness in the PKCS11.5 public key encryption standard allows attackers to recover plaintext of messages encrypted with SSH. Description A weakness in some SSH products using the SSH1 protocol may allow an attacker...

SSH connections using RC4 and password authentication can be replayed

Overview This vulnerability may allow an attacker to replay a captured SSH1 session. Description Preconditions: Client requests RC4 and the server grants request Client uses password authentication When an SSH1 session using the RC4 cipher is established, the client and server agree upon a sessio...

NT admin password change algorithms expose user plaintext passwords

eye-catching subject line, huh? well, under specific circumstances, unfortunately, it's true. as it's now early morning, i shall be reasonably brief. conditions required if using NTLMv1 LmCompatibilibyLevel=0: - NT admin runs USRMGR.EXE or SRVMGR.EXE and either adds a new user, workstation or...

CVE-1999-0151

The SATAN session key may be disclosed if the user points the web browser to other sites, possibly allowing root access...

CVE-1999-0151

CVE-1999-0151 corresponds to the SATAN tool vulnerability where the session key can be disclosed if the user navigates the browser to other sites, potentially enabling root access. Connected sources confirm the issue affects SATAN and describe the risk of session key disclosure leading to elevate...