3996 matches found
FreeBSD : drupal -- multiple vulnerabilities (ecedde1c-5128-11dd-a4e1-0030843d3802)
The Drupal Project reports : Free tagging taxonomy terms can be used to insert arbitrary script and HTML code cross site scripting or XSS on node preview pages. A successful exploit requires that the victim selects a term containing script code and chooses to preview the node. This issue affects...
CVE-2008-3172
Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...
Cross site scripting
Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this issue may exist becaus...
CVE-2008-3173
Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this issue may exist becaus...
CVE-2008-3170
Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and...
Cross site scripting
Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and...
Cross site scripting
Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...
CVE-2008-3173
Microsoft Internet Explorer is affected by CVE-2008-3173, where web sites can set cookies for domains with a public suffix containing more than one dot, enabling session fixation and potential HTTP session hijacking. The issue is tied to an insufficient fix for CVE-2004-0866, suggesting a remedia...
CVE-2008-3173
Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this issue may exist becaus...
CVE-2008-3172
CVE-2008-3172 affects the Opera browser. The issue arises because websites could set cookies for country-specific top-level domains that have DNS A records (examples include co.tv). This could enable remote attackers to perform a session fixation attack and hijack a user’s HTTP session. The avail...
CVE-2008-3170
Technical details about CVE-2008-3170 are not publicly available in the provided connected documents; monitor for updates.
SA-2008-044 - Drupal core - Multiple vulnerabilities
Multiple vulnerabities and weaknesses were discovered in Drupal. Neither of these are readily exploitable. Cross site scripting Free tagging taxonomy terms can be used to insert arbitrary script and HTML code cross site scripting or XSS on node preview pages. A successful exploit requires that th...
Cybozu Garoon session fixation vulnerability
Overview Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability. Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the...
Session fixation
Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...
CVE-2008-2970
Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...
CVE-2008-2970
Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...
CVE-2008-2970
CVE-2008-2970 describes multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) versions 1.4.3.1 and 1.4.2.8 and earlier. The issue allows remote attackers to hijack user sessions by supplying a crafted PHPSESSID value targeted at index.php and login.php within the homepg/ dir...
JVN#18700809 Cybozu Garoon session fixation vulnerability
Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the attacker. Impact A remote attacker impersonating a logged in user may execute arbitrary code...
Aipo session fixation vulnerability
Overview Aipo, groupware from Aimluck, Inc., contains a session fixation vulnerability. Aipo from Aimluck, Inc. is groupware including functions such as scheduler and intra-blogging. Aipo contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user log...