CVE-2005-4731: Undefined Security Weakness

The Next action in PEAR HTMLQuickFormController 1.0.4 includes the SID in the URL even when session.useonlycookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors...

CVE-2006-0511

Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that "This is a customer specific iss...

CVE-2006-0511

Blackboard Academic Suite 6.0 and earlier is affected by a session handling weakness: when a user is idle and then de-authenticates, the system may not properly clear session information, allowing a subsequent user to log in as the previous user and gain privileges. The issue is disputed by the v...

CVE-2006-0511: Undefined Security Weakness

Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that "This is a customer specific iss...

phorum5x.txt

======================================================================================= XOR Crew :: Security Advisory 9/1/2005 ======================================================================================= Phorum 5.x Multiple XSS and Session Hijacking Vulnerabilities...

JVN#74012178 Movable Type session management vulnerability

Impact A remote attacker could freely manipulate a web log by posting or deleting blog entries. Solution Products Affected Movable Type 3.151-ja and earlier...

phpbb2013user.txt

------------------------------------------------------------------------ phpBB 2.0.13 user level exploit By : Morinex e-mail : [email protected] date : 20-03-2005 greetz : Ali7 for helping me =P , Zeltha , code , ASC and w00pie.NL Exploit not founded by me! Dunno who is the founder of this bug. T...

Mandrake Linux Security Advisory : ruby (MDKSA-2004:128)

Andres Salomon noticed a problem with the CGI session management in Ruby. The CGI:Session's FileStore implementations store session information in an insecure manner by just creating files and ignoring permission issues CVE-2004-0755. The ruby developers have corrected a problem in the ruby CGI...

RHEL 2.1 / 3 : ruby (RHSA-2004:441)

An updated ruby package that fixes insecure file permissions for CGI session files is now available. Ruby is an interpreted scripting language for object-oriented programming. Andres Salomon reported an insecure file permissions flaw in the CGI session management of Ruby. FileStore created world...

Low: Red Hat Security Advisory: ruby security update

An updated ruby package that fixes insecure file permissions for CGI session files is now available. Ruby is an interpreted scripting language for object-oriented programming. Andres Salomon reported an insecure file permissions flaw in the CGI session management of Ruby. FileStore created world...

Debian DSA-537-1 : ruby - insecure file permissions

Andres Salomon noticed a problem in the CGI session management of Ruby, an object-oriented scripting language. CGI::Session's FileStore and presumably PStore, but not in Debian woody implementations store session information insecurely. They simply create files, ignoring permission issues. This c...

CVE-2002-0396: Undefined Security Weakness

The web management server for Red-M 1050 Bluetooth Access Point does not use session-based credentials to authenticate users, which allows attackers to connect to the server from the same IP address as a user who has already established a session...

FreeBSD : Ruby insecure file permissions in the CGI session management (e811aaf1-f015-11d8-876f-00902714cc7c)

According to a Debian Security Advisory : Andres Salomon noticed a problem in the CGI session management of Ruby, an object-oriented scripting language. CGI::Session's FileStore and presumably PStore ... implementations store session information insecurely. They simply create files, ignoring...

[SECURITY] [DSA 537-1] New Ruby packages fix insecure CGI session management

-------------------------------------------------------------------------- Debian Security Advisory DSA 537-1 [email protected] http://www.debian.org/security/ Martin Schulze August 16th, 2004 http://www.debian.org/security/faq -...

DSA-537 ruby - insecure file permissions

Bulletin has no description...

Ruby insecure file permissions in the CGI session management

According to a Debian Security Advisory: Andres Salomon noticed a problem in the CGI session management of Ruby, an object-oriented scripting language. CGI::Session's FileStore and presumably PStore ... implementations store session information insecurely. They simply create files, ignoring...

should be able to login only via https

you should be able to configure JIRA to login via HTTPS. this is almost possible in 2.4.1. You can specify an https URL in security-config.xml as the login.url parameter. this makes loing links from e.g. the issue view page work correctly. a slight problem here is that the session remiains in the...

should be able to login only via https

you should be able to configure JIRA to login via HTTPS. this is almost possible in 2.4.1. You can specify an https URL in security-config.xml as the login.url parameter. this makes loing links from e.g. the issue view page work correctly. a slight problem here is that the session remiains in the...

geeklog.txt

Products: Geeklog 1.3.7sr1 and below http://www.geeklog.net Date: 29 May 2003 Author: pokleyzz Contributors: skatscan-associates.net shaharilatscan-associates.net muniratscan-associates.net URL: http://www.scan-associates.net Summary: Geeklog 1.3.7sr1 and below multiple vulnerabilities. Descripti...

PHP 4.3.2 released

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 After a lengthy QA process, PHP 4.3.2 is finally out! This maintenance release solves a lot of bugs found in earlier PHP versions and is a strongly recommended upgrade for all PHP users. PHP 4.3.2 contains, among others, following important fixes,...